When s3c64xx-spi is instantiated from device tree an instance of
struct s3c64xx_spi_csinfo is dynamically allocated in the driver.
For non-dt platform it is passed from board code through
spi_register_board_info(). On error path in s3c64xx_spi_setup()
function there is an attempt to free this data struct
s3c64xx_spi_csinfo object as it would have been allocated in the
driver for both, dt and non-dt based platforms. This leads to
following bug when gpio request fails:

spi spi1.0: Failed to get /CS gpio [21]: -16
kernel BUG at mm/slub.c:3478!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0    Not tainted  (3.6.0-rc5-00092-g9b0b493-dirty #6111)
PC is at kfree+0x148/0x158
LR is at s3c64xx_spi_setup+0xac/0x290
pc : [<c00a513c>]    lr : [<c0227014>]    psr: 40000013
sp : ee043e10  ip : c032883c  fp : c0481f7c
r10: ee0abd80  r9 : 00000063  r8 : 00000000
r7 : ee129e78  r6 : ee104a00  r5 : fffffff0  r4 : c047bc64
r3 : 40000400  r2 : c047bc64  r1 : c04def60  r0 : 0004047b
Flags: nZcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 4000404a  DAC: 00000015
Process swapper/0 (pid: 1, stack limit = 0xee0422f0)
Stack: (0xee043e10 to 0xee044000)
...
[<c00a513c>] (kfree+0x148/0x158) from [<c0227014>] (s3c64xx_spi_setup+0xac/0x290)
[<c0227014>] (s3c64xx_spi_setup+0xac/0x290) from [<c02251a4>] (spi_setup+0x34/0x4c)
[<c02251a4>] (spi_setup+0x34/0x4c) from [<c02258d0>] (spi_add_device+0x98/0x128)
[<c02258d0>] (spi_add_device+0x98/0x128) from [<c02259d4>] (spi_new_device+0x74/0xa8)
[<c02259d4>] (spi_new_device+0x74/0xa8) from [<c0225a2c>] (spi_match_master_to_boardinfo+0x24/0x44)
[<c0225a2c>] (spi_match_master_to_boardinfo+0x24/0x44) from [<c0225b40>] (spi_register_master+0xf4/0x2a8)
[<c0225b40>] (spi_register_master+0xf4/0x2a8) from [<c043fe0c>] (s3c64xx_spi_probe+0x34c/0x42c)
[<c043fe0c>] (s3c64xx_spi_probe+0x34c/0x42c) from [<c01fc198>] (platform_drv_probe+0x18/0x1c)

There should be no attempt to kfree controller_data when it was
externally provided through the board code. Fix this by freeing
controller_data only when dev->of_node is not null.
Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Acked-by: NKukjin Kim <kgene.kim@samsung.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

Adds pinctrl support to support OMAP platforms that boot from DT
and rely on pinctrl support to set pinmuxes.
Signed-off-by: NMatt Porter <mporter@ti.com>
Acked-by: NShubhrajyoti D <shubhrajyoti@ti.com>
Acked-by: NTony Lindgren <tony@atomide.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

Amend the PL022 pin controller to optionally take a pin control
handle and set the state of the pins to "default" on boot and
runtime resume, and to "sleep" at runtime suspend. This way we
will dynamically save power on the SPI busses, for example some
electronic designs may be able to ground the pins when unused
instead of pull-up. Some pin controllers may want to set the
pins as wake-up sources when sleeping.

Effect on platforms using the PL022 driver:

- If the platform does not use pin control - no semantic effect,
  the pinctrl stubs will kick in and resolve the situation.

- Platforms using this driver and have pin control but no
  function defined for the PL022 need to either supply a
  "default" function in their map or enable pinctrl dummies
  so the driver is satisfied.

- Platforms using this driver with hogs for setting up the PL022
  pin control - stop using hogs to take the pl022 pin control
  handle, let the driver handle this.

I'be looked at some platforms that may be affected:

- SPEAr: appears to define the proper functions in their device
  trees and not hogging them, so things should be smooth, the
  driver will simply start to take its pins.

- Ux500: the proper function is defined and will be taken properly
  by the driver. New sleep states introduced by a separate patch to
  ux500 but no regression, since the default state is sufficient.

- U300: old hog deleted as part of this patch.

- LPC32xx: does not appear to be using pinctrl.

- ARM Integrator IMPD1, RealView & Versatile: does not use pinctrl.
Tested-by: NRoland Stigge <stigge@antcom.de>
Signed-off-by: NPatrice Chotard <patrice.chotard@stericsson.com>
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

Currently in omap2_mcspi_txrx_dma the tx and the rx support is
interleaved. Make the rx related code in omap2_mcspi_rx_dma
and the tx related code omap2_mcspi_tx_dma and call the functions.

While at it remove the braces in the if statements which has only
one line.
Also fix ["foo * bar" to "foo *bar"] warn for the rx and tx variables.

Only a cleanup no functional change.
Signed-off-by: NShubhrajyoti D <shubhrajyoti@ti.com>
Tested-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

The gpio_ was missing from the name.  Add a name for the parameter while
we're at it since GCC warns.
Reported-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

devm free functions should not have to be explicitly used.

A semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
@@

(
* devm_kfree(...);
|
* devm_free_irq(...);
|
* devm_iounmap(...);
|
* devm_release_region(...);
|
* devm_release_mem_region(...);
)
// </smpl>
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

The new chip select handling via GPIO introduced a pointer computation bug:

	(int *) pl022 + sizeof(struct pl022)

doesn't point to the data immediately after the actual struct pl022 (as was
intended) but to a multiple of bytes after it because of the (int *) type.

Replacing the kludgy pointer arithmetic with managed memory allocation for the
chip selects.
Reported-by: NShiraz Hashim <shiraz.linux.kernel@gmail.com>
Signed-off-by: NRoland Stigge <stigge@antcom.de>
Reviewed-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

module_spi_driver eliminates module_init and module_exit
calls and makes the code simpler.
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

This patch adds DT bindings to the spi-gpio driver and some
documentation about how to use it.
Signed-off-by: NDaniel Mack <zonque@gmail.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

The spi-gpio driver currently assumes the chipselect gpio number is
stored in ->controller_data of the device's static board information.

In devicetree environments, this information is unavailable and has to
be derived from the DT node.

This patch moves the gpio storage to the controller's private data so
the DT bindings can easily build upon the driver.
Signed-off-by: NDaniel Mack <zonque@gmail.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

Suspend and resume functions call spi_master_get() without matching
spi_master_put(). The extra references are unnecessary and cause subsequent
module unload attempts to fail. Drop the calls.
Signed-off-by: NGuenter Roeck <linux@roeck-us.net>
Acked-by: NKukjin Kim <kgene.kim@samsung.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

The call sequence spi_alloc_master/spi_register_master/spi_unregister_master
is complete; it reduces the device reference count to zero, which results in
device memory being freed. An extra call to spi_master_put is unnecessary
and results in an access to free memory. Drop it.

Also, the device subsystem resets device driver data to NULL after the call to
the remove function returns, so there is no need to do it here.
Signed-off-by: NGuenter Roeck <linux@roeck-us.net>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

The call to spi_unregister_master() in the device remove function frees device
memory, and with it any device local data. However, device local data is still
accessed after the call to spi_unregister_master().

Acquire a reference to the SPI master device and release it after cleanup is
complete to solve the problem.
Signed-off-by: NGuenter Roeck <linux@roeck-us.net>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

The call sequence spi_alloc_master/spi_register_master/spi_unregister_master
is complete; it reduces the device reference count to zero, which results in
device memory being freed. The remove function accesses the freed memory after
the call to spi_unregister_master(), _and_ it calls spi_master_put on the freed
memory.

Acquire a reference to the SPI master device and release it after cleanup is
complete (with the existing spi_master_put) to solve the problem.

Also, the device subsystem ensures that the remove function is only called once,
and resets device driver data to NULL. Remove the respective check and drop the
unnecessaary call to platform_set_drvdata().
Signed-off-by: NGuenter Roeck <linux@roeck-us.net>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

If the I2C bus master driver does not support the required functionality,
the driver returns -ENODEV. This causes a silent probe failure without error
message. Since the device has to be explicitly instantiated, and the user
should know the correct bus, this event really reflects an error condition.
Replace error return value with -EINVAL to trigger an error message showing
that the probe function failed.
Signed-off-by: NGuenter Roeck <linux@roeck-us.net>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

Several SPI controller drivers have defined differently named properties for
the number of chip selects.  Now adding "num-cs" as a reference name for new
bindings.
Signed-off-by: NRoland Stigge <stigge@antcom.de>
Reviewed-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

This patch adds device tree support to the spi-pl022 driver.

Based on the initial patch by Alexandre Pereira da Silva <aletes.xgr@gmail.com>
Signed-off-by: NRoland Stigge <stigge@antcom.de>
Acked-by: NAlexandre Pereira da Silva <aletes.xgr@gmail.com>
Reviewed-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

This patch adds the ability for the driver to control the chip select directly.
This enables independence from cs_control callbacks.  Configurable via
platform_data, to be extended as DT in the following patch.

Based on the initial patch by Alexandre Pereira da Silva <aletes.xgr@gmail.com>
Signed-off-by: NRoland Stigge <stigge@antcom.de>
Acked-by: NAlexandre Pereira da Silva <aletes.xgr@gmail.com>
Reviewed-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

This driver adds support for NXP SC18IS602/603 I2C to SPI bus bridge.
Signed-off-by: NGuenter Roeck <linux@roeck-us.net>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

The call to spi_unregister_master() in the device remove function frees device
memory, and with it any device local data. However, device local data is still
accessed after the call to spi_unregister_master().

Acquire a reference to the SPI master device and release it after cleanup is
complete to solve the problem.
Signed-off-by: NGuenter Roeck <linux@roeck-us.net>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

The call to spi_unregister_master() in the device remove function frees device
memory, and with it any device local data. However, device local data is still
accessed after the call to spi_unregister_master().

Acquire a reference to the SPI master device and release it after cleanup is
complete to solve the problem.
Signed-off-by: NGuenter Roeck <linux@roeck-us.net>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

The call sequence spi_alloc_master/spi_register_master/spi_unregister_master is
complete; it reduces the device reference count to zero, which results in
device memory being freed. An extra call to spi_master_put is unnecessary
and results in an access to free memory.

At the same time, since the call to spi_unregister_master results in device
memory being freed, it must no longer be accessed afterwards.

To fix both problems, call spi_master_get to get an extra reference to the
device, and call spi_master_put only after the last access to device data.
Signed-off-by: NGuenter Roeck <linux@roeck-us.net>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

The call to spi_master_put() is needed to free device memory. It must be called
after spi_alloc_master, and must only be called after the device memory is no
longer used.
Signed-off-by: NGuenter Roeck <linux@roeck-us.net>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

The call sequence spi_alloc_master/spi_register_master/spi_unregister_master
is complete; it reduces the device reference count to zero, which results in
device memory being freed. An extra call to spi_master_put is unnecessary
and results in an access to free memory. Drop it.
Signed-off-by: NGuenter Roeck <linux@roeck-us.net>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

At remove we shouldnt be using the autosuspend timeout as we are
calling pm_runtime_disable immediately after.
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NShubhrajyoti D <shubhrajyoti@ti.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

Call the pm_runtime functions directly making room for possible
pm optimisations. Also the runtime functions aren't just about
enabling and disabling of clocks though it does enable clocks also.
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NShubhrajyoti D <shubhrajyoti@ti.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

Remove the macro MOD_REG_BIT instead make the bit field modifications
directly. This deletes a branch operation in cases where the the set
is predecided. While at it optimise two sequential bit clear in one step.
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NShubhrajyoti D <shubhrajyoti@ti.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

Initialize return variable before exiting on an error path.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
(
if@p1 (\(ret < 0\|ret != 0\))
 { ... return ret; }
|
ret@p1 = 0
)
... when != ret = e1
    when != &ret
*if(...)
{
  ... when != ret = e2
      when forall
 return ret;
}

// </smpl>
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

Remove the call of platform_set_drvdata(pdev, NULL) as they are not
needed anymore.
Signed-off-by: NShubhrajyoti D <shubhrajyoti@ti.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

Instead of having to define the match table to NULL if CONFIG_OF isn't
set, use the of_match_ptr() macro which will do this for us.
Signed-off-by: NTobias Klauser <tklauser@distanz.ch>
Acked-by: NRob Herring <rob.herring@calxeda.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

Replace the deprecated master->transfer with transfer_one_message()
and allow the SPI subsystem handle all the queuing of messages.
Signed-off-by: NAndrew Lunn <andrew@lunn.ch>
Acked-by: NLinus Walleij <linus.walleij@linaro.org>
Acked-by: NSebastian Hesselbarth <sebastian.hesselbarth@googlemail.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

Following a report of a crash during an automount expire I found that
the locking in fs/autofs4/expire.c:get_next_positive_subdir() was wrong.
Not only is the locking wrong but the function is more complex than it
needs to be.

The function is meant to calculate (and dget) the next entry in the list
of directories contained in the root of an autofs mount point (an autofs
indirect mount to be precise). The main problem was that the d_lock of
the owner of the list was not being taken when walking the list, which
lead to list corruption under load. The only other lock that needs to
be taken is against the next dentry candidate so it can be checked for
usability.
Signed-off-by: NIan Kent <raven@themaw.net>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Pull VFIO fix from Alex Williamson:
 "Just a trivial patch to include vfio.h in the installed headers so we
  can complete userspace integration into QEMU."

* tag 'vfio-for-v3.6-rc1' of git://github.com/awilliam/linux-vfio:
  vfio: Include vfio.h in installed headers

Pull fuse updates from Miklos Szeredi.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
  fuse: verify all ioctl retry iov elements
  fuse: add missing INIT flag descriptions
  fuse: add missing INIT flags
  fuse: update attributes on aio_read
  fuse: invalidate inode mapping if mtime changes
  fuse: add FUSE_AUTO_INVAL_DATA init flag

Merge tag 'stable/for-linus-3.6-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

Pull Xen fix from Konrad Rzeszutek Wilk:
 "Way back in v3.5 we added a mechanism to populate back pages that were
  released (they overlapped with MMIO regions), but neglected to reserve
  the proper amount of virtual space for extend_brk to work properly.

  Coincidentally some other commit aligned the _brk space to larger area
  so I didn't trigger this until it was run on a machine with more than
  2GB of MMIO space."

 * On machines with large MMIO/PCI E820 spaces we fail to boot b/c
   we failed to pre-allocate large enough virtual space for extend_brk.

* tag 'stable/for-linus-3.6-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/p2m: Reserve 8MB of _brk space for P2M leafs when populating back.

Pull SuperH fixes from Paul Mundt.

* tag 'sh-for-linus' of git://github.com/pmundt/linux-sh:
  sh: intc: Handle domain association for sparseirq pre-allocated vectors.
  sh: sh7269: Fix LCD pinmux
  sh: dma: fix request_irq usage

Moved to djbw@fb.com

Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: NDan Williams <djbw@fb.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

When dumping "Code: " sections from an oops, the trapping instruction
%rip points to can be a string copy

  2b:*  f3 a5                   rep movsl %ds:(%rsi),%es:(%rdi)

and the line contain a bunch of ":".  Current "cut" selects only the and
the second field output looks funnily overlaid this:

  2b:*  f3 a5                   rep movsl %ds     <-- trapping instruction:(%rsi),%es:(%rdi

Fix this by selecting the remaining fields too.

Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: linux-kbuild@vger.kernel.org
Signed-off-by: NBorislav Petkov <borislav.petkov@amd.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Pull two slave-dmaengine fixes from Vinod Koul:
 "One fixes the correct use of clock API in imx driver and the other
  enables clock for tegra driver, which is used for other tegra driver
  conversion to dmanegine in -next."

* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
  dma: tegra: enable/disable dma clock
  dma: imx-dma: Fix kernel crash due to missing clock conversion