If a request already in the queue is passed to tegra_dma_enqueue_req,
tegra_dma_req.node->{next,prev} will end up pointing to itself instead
of at tegra_dma_channel.list, which is the way a the end-of-list
should be set up. When the DMA request completes and is list_del'd,
the list head will still point at it, yet the node's next/prev will
contain the list poison values. When the next DMA request completes,
a kernel panic will occur when those poison values are dereferenced.

This makes the DMA driver more robust in the face of buggy clients.
Signed-off-by: NStephen Warren <swarren@nvidia.com>
Signed-off-by: NColin Cross <ccross@android.com>

Merge branch 'tegra-arch' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound-2.6 into outside-for-next

Add basic support for CompuLab TrimSlice platform
Signed-off-by: NMike Rapoport <mike@compulab.co.il>
Signed-off-by: NColin Cross <ccross@android.com>

Signed-off-by: NColin Cross <ccross@android.com>

Adding one single defconfig for the tegra family of boards, to over time
cover the superset of supported platform and drivers.
Signed-off-by: NOlof Johansson <olof@lixom.net>
Signed-off-by: NColin Cross <ccross@android.com>

Sometimes, due to high interrupt latency in the continuous mode
of DMA transfer, the half buffer complete interrupt is handled
after DMA has transferred the full buffer.  When this is detected,
stop DMA immediately and restart with the next buffer if the next
buffer is ready.

originally fixed by Victor(Weiguo) Pan <wpan@nvidia.com>

In place of using the simple spin_lock()/spi_unlock() in the
interrupt thread, using the spin_lock_irqsave() and
spin_unlock_irqrestore(). The lock is shared between the normal
process context and interrupt context.

originally fixed by Laxman Dewangan (ldewangan@nvidia.com)

The use of shadow registers caused memory corruption at physical
address 0 because the enable bit was not shadowed, and assuming it
needed to be set would enable an unconfigured dma block.  Most of the
register accesses don't need to know the previous state of the
registers, and the few places that do need to modify only a few bits
in the registers are the same ones that were sometimes incorrectly
setting the enable bit.  This patch convert tegra_dma_update_hardware
to set the entire register, and the other users to read-modify-write,
and drops the shadow registers completely.

Also fixes missing locking in tegra_dma_allocate_channel
Signed-off-by: NColin Cross <ccross@android.com>

Signed-off-by: NColin Cross <ccross@android.com>

On Tegra, calling clk_set_rate on the CPU clock may call into the
regulator API.  If the regulator driver that controls the CPU
voltage rail has been suspended, this can lead to attempted
communication with a hardware block that has already been turned
off.

Adds a SUSPEND_PREPARE notification hook to drop the frequency to
the lowest possible during suspend.

Also adds 216MHz (off of PLLP) as the lowest CPU frequency, which
allows PLLX to be turned off.
Signed-off-by: NColin Cross <ccross@android.com>

Adds gart, hdmi, avp, host1x, and pwm controllers to mach/iomap.h
Signed-off-by: NGary King <gking@nvidia.com>
Signed-off-by: NColin Cross <ccross@android.com>

Signed-off-by: NColin Cross <ccross@android.com>

Signed-off-by: NColin Cross <ccross@android.com>

Implement read_persistent_clock by reading the Tegra RTC
registers that stay running during suspend.

Save and restore the timer configuration register in
suspend.
Signed-off-by: NColin Cross <ccross@android.com>

Adds missing drive pingroups, saves all drive pingroups in
suspend, and restores the pinmux registers in the proper order.
Signed-off-by: NGary King <gking@nvidia.com>
Signed-off-by: NColin Cross <ccross@android.com>

Save and restore pll and osc state during suspend
Add digital audio clocks
Update clk dev associations
Correct max clock frequencies
Add pll_p as additional cpu clock state
Add values to plld table
Fix register offset for sdmmc4 clock
Add blink timer to tegra2_clocks
Signed-off-by: NColin Cross <ccross@android.com>

Signed-off-by: NColin Cross <ccross@android.com>

Fixes typo in INT_CPU1_PMU_INTR (original fix from Will Deacon)
Adds board irqs
Signed-off-by: NColin Cross <ccross@android.com>

Signed-off-by: NColin Cross <ccross@android.com>

Signed-off-by: NColin Cross <ccross@android.com>

* master.kernel.org:/home/rmk/linux-2.6-arm:
  ALSA: AACI: allow writes to MAINCR to take effect
  ARM: Update mach-types
  ARM: 6652/1: ep93xx: correct the end address of the AC97 memory resource
  ARM: mxs/imx28: remove now unused clock lookup "fec.0"
  ARM: mxs: fix clock base address missing
  ARM: mxs: acknowledge gpio irq
  ARM: mach-imx/mach-mx25_3ds: Fix section type
  ARM: imx: Add VPR200 and MX51_3DS entries to uncompress.h
  ARM i.MX23: use correct register for setting the rate
  ARM i.MX23/28: remove secondary field from struct clk. It's unused
  ARM i.MX28: use correct register for setting the rate
  ARM i.MX28: fix bit operation

* git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable: (33 commits)
  Btrfs: Fix page count calculation
  btrfs: Drop __exit attribute on btrfs_exit_compress
  btrfs: cleanup error handling in btrfs_unlink_inode()
  Btrfs: exclude super blocks when we read in block groups
  Btrfs: make sure search_bitmap finds something in remove_from_bitmap
  btrfs: fix return value check of btrfs_start_transaction()
  btrfs: checking NULL or not in some functions
  Btrfs: avoid uninit variable warnings in ordered-data.c
  Btrfs: catch errors from btrfs_sync_log
  Btrfs: make shrink_delalloc a little friendlier
  Btrfs: handle no memory properly in prepare_pages
  Btrfs: do error checking in btrfs_del_csums
  Btrfs: use the global block reserve if we cannot reserve space
  Btrfs: do not release more reserved bytes to the global_block_rsv than we need
  Btrfs: fix check_path_shared so it returns the right value
  btrfs: check return value of btrfs_start_ioctl_transaction() properly
  btrfs: fix return value check of btrfs_join_transaction()
  fs/btrfs/inode.c: Add missing IS_ERR test
  btrfs: fix missing break in switch phrase
  btrfs: fix several uncheck memory allocations
  ...

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc: Fix hcall tracepoint recursion
  powerpc/numa: Fix bug in unmap_cpu_from_node
  powerpc/numa: Disable VPHN on dedicated processor partitions
  powerpc/numa: Add length when creating OF properties via VPHN
  powerpc/numa: Check for all VPHN changes
  powerpc/numa: Only use active VPHN count fields
  powerpc/pseries: Remove unnecessary variable initializations in numa.c
  powerpc/pseries: Fix brace placement in numa.c
  powerpc/pseries: Fix typo in VPHN comments
  powerpc: Fix some 6xx/7xxx CPU setup functions
  powerpc: Pass the right cpu_spec to ->setup_cpu() on 64-bit
  powerpc/book3e: Protect complex macro args in mmu-book3e.h
  powerpc: Fix pfn_valid() when memory starts at a non-zero address

Merge branch 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6

* 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6:
  arm: omap4: panda: remove usb_nop_xceiv_register(v1)
  OMAP1: Fix non-working LCD on OMAP310
  OMAP3: Devkit8000: Change lcd power pin
  omap1: remove duplicated #include
  arm: mach-omap2: mux: free allocated memory on error exit
  arm: mach-omap2: board-rm680: fix rm680_vemmc regulator constraints
  OMAP: PM: SmartReflex: Fix possible null pointer read access
  OMAP: PM: SmartReflex: Fix possible memory leak
  arm: mach-omap2: voltage: debugfs: fix memory leak
  OMAP3: PM: fix save secure RAM to restore MPU power state
  OMAP: PM: SmartReflex: Add missing IS_ERR test

Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86, nx: Mark the ACPI resume trampoline code as +x

In prepare_kernel_cred() since 2.6.29, put_cred(new) is called without
assigning new->usage when security_prepare_creds() returned an error.  As a
result, memory for new and refcount for new->{user,group_info,tgcred} are
leaked because put_cred(new) won't call __put_cred() unless old->usage == 1.

Fix these leaks by assigning new->usage (and new->subscribers which was added
in 2.6.32) before calling security_prepare_creds().
Signed-off-by: NTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

In cred_alloc_blank() since 2.6.32, abort_creds(new) is called with
new->security == NULL and new->magic == 0 when security_cred_alloc_blank()
returns an error.  As a result, BUG() will be triggered if SELinux is enabled
or CONFIG_DEBUG_CREDENTIALS=y.

If CONFIG_DEBUG_CREDENTIALS=y, BUG() is called from __invalid_creds() because
cred->magic == 0.  Failing that, BUG() is called from selinux_cred_free()
because selinux_cred_free() is not expecting cred->security == NULL.  This does
not affect smack_cred_free(), tomoyo_cred_free() or apparmor_cred_free().

Fix these bugs by

(1) Set new->magic before calling security_cred_alloc_blank().

(2) Handle null cred->security in creds_are_invalid() and selinux_cred_free().
Signed-off-by: NTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
  cifs: remove checks for ses->status == CifsExiting
  cifs: add check for kmalloc in parse_dacl
  cifs: don't send an echo request unless NegProt has been done
  cifs: enable signing flag in SMB header when server has it on
  cifs: Possible slab memory corruption while updating extended stats (repost)
  CIFS: Fix variable types in cifs_iovec_read/write (try #2)
  cifs: fix length vs. total_read confusion in cifs_demultiplex_thread

take offset of start position into account when calculating page count.
Signed-off-by: NYan, Zheng <zheng.z.yan@intel.com>
Signed-off-by: NChris Mason <chris.mason@oracle.com>

ses->status is never set to CifsExiting, so these checks are
always false.
Tested-by: NJG <jg@cms.ac>
Signed-off-by: NJeff Layton <jlayton@redhat.com>
Signed-off-by: NSteve French <sfrench@us.ibm.com>

The AACI TRM requires the MAINCR enable bit to be held zero for two
bitclk cycles plus three apb_pclk cycles.  Use a delay of 1us to
ensure this.

Ensure that writes to MAINCR to change the addressed codec only happen
when required, and that they take effect in a similar manner to the
above, otherwise we seem to occasionally have stuck slot busy bits.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

We reserve lowmem for the things that need it, like the ACPI
wakeup code, way early to guarantee availability.  This happens
before we set up the proper pagetables, so set_memory_x() has no
effect.

Until we have a better solution, use an initcall to mark the
wakeup code executable.
Originally-by: NMatthieu Castet <castet.matthieu@free.fr>
Signed-off-by: NH. Peter Anvin <hpa@zytor.com>
Cc: Matthias Hopf <mhopf@suse.de>
Cc: rjw@sisk.pl
Cc: Suresh Siddha <suresh.b.siddha@intel.com>
LKML-Reference: <4D4F8019.2090104@zytor.com>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

Spinlocks on shared processor partitions use H_YIELD to notify the
hypervisor we are waiting on another virtual CPU. Unfortunately this means
the hcall tracepoints can recurse.

The patch below adds a percpu depth and checks it on both the entry and
exit hcall tracepoints.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Acked-by: NSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
CC: stable@kernel.org

When converting to the new cpumask code I screwed up:

-       if (cpu_isset(cpu, numa_cpumask_lookup_table[node])) {
-               cpu_clear(cpu, numa_cpumask_lookup_table[node]);
+       if (cpumask_test_cpu(cpu, node_to_cpumask_map[node])) {
+               cpumask_set_cpu(cpu, node_to_cpumask_map[node]);

This was introduced in commit 25863de0 (powerpc/cpumask: Convert NUMA code
to new cpumask API)

Fix it.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Cc: <stable@kernel.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

There is no need to start up the timer and monitor topology changes on a
dedicated processor partition, so disable it.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

The rest of the NUMA code expects an OF associativity property with
the first cell containing the length. Without this fix all topology changes
cause us to misparse the property and put the cpu into node 0.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

The hypervisor uses unsigned 1 byte counters to signal topology changes to
the OS. Since they can wrap we need to check for any difference, not just if
the hypervisor count is greater than the previous count.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

VPHN supports up to 8 distance fields but the number of entries in
ibm,associativity-reference-points signifies how many are in use.
Don't look at all the VPHN counts, only distance_ref_points_depth
worth.

Since we already cap our distance metrics at MAX_DISTANCE_REF_POINTS,
use that to size the VPHN arrays and add a BUILD_BUG_ON to avoid it growing
larger than the VPHN maximum of 8.
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>