DMA mode 1 data corruption anomaly on Blackfin systems.  This issue is
specific to the Blackfin silicon as the bug appears to be related to the
connection of the musb ip to the bus/dma fabric.

Data corruption when using USB DMA mode 1. (Issue manager 17-01-0105)
DMA mode 1 allows large size transfers to generate a single interrupt
at the end of the entire transfer.  The transfer is split up in packets
of length specified in the Maximum Packet Size field for that endpoint.
If the transfer size is not an integer multiple of the Maximum Packet
Size, a short packet will be present at the end of the transfer.

Under certain conditions this packet may be corrupted in the USB FIFO.

Workaround:
Use DMA mode 1 to transfer (n* Maximum Packet Size) and schedule DMA
mode 0 to transfer the short packet.

As an example if your transfer size is 33168 bytes and Maximum Packet
Size equals 512, schedule [33168 - (33168 mod 512)] in DMA mode 1 and
the remainder (33168 mod 512) in DMA mode 0.
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Below crash observed with commit 7acc6197
(usb: musb: Idle path retention and offmode support for OMAP3)
during board reboot.

The musb clock was disabled when musb_shutdown() was called by
platform_drv_shutdown in which there are register accesses.
call pm_runtime_get_sync() and pm_runtime_put_sync() in the
musb_shutdown function.

/ # [  172.368774] Unhandled fault: imprecise external abort (0x1406) at 0x400f0000
[  172.376190] Internal error: : 1406 [#1] SMP
[  172.380554] last sysfs file: /sys/devices/platform/omap/omap_i2c.4/i2c-4/i2c-dev/i2c-4/dev
[  172.389221] Modules linked in:
[  172.392456] CPU: 0    Tainted: G        W    (2.6.38-06671-geddecbb6 #33)
[  172.399475] PC is at do_raw_spin_unlock+0x50/0xc0
[  172.404418] LR is at _raw_spin_unlock_irqrestore+0x24/0x44
[  172.410186] pc : [<c069bfdc>]    lr : [<c085a7f8>]    psr: 60000093
[  172.410186] sp : ee993e40  ip : c0d00240  fp : bea9cf14
[  172.422241] r10: 00000000  r9 : ee992000  r8 : c04b2fa8
[  172.427703] r7 : 00000000  r6 : c0fa46c0  r5 : ef966124  r4 : ef966124
[  172.434539] r3 : ef92cbc0  r2 : ef92cbc0  r1 : 00000000  r0 : ef966124
[  172.441406] Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
[  172.448974] Control: 10c5387d  Table: ae8d804a  DAC: 00000015
[  172.454986] Process init (pid: 1094, stack limit = 0xee9922f8)
[  172.461120] Stack: (0xee993e40 to 0xee994000)
[  172.465667] 3e40: a0000013 c085a7f8 ef966124 a0000013 c0fa46c0 c0761ab4 c0761a70 ef95c008
[  172.474273] 3e60: ef95c014 c06e2fd0 c06e2fbc c06dea90 00000000 01234567 28121969 c04fccb4
[  172.482849] 3e80: 00000000 c04fcd04 c0a302bc c04fce44 c0a02600 00000001 00000000 c085cd04
[  172.491424] 3ea0: 00000000 00000002 c09ea000 c085afc0 ee993f24 00000000 00040001 00000445
[  172.499999] 3ec0: a8eb9d34 00000027 00000000 00000000 00000000 c0a56a4c 00000000 00000000
[  172.508575] 3ee0: 00000002 60000093 00000000 c0519aac 00000002 00000080 00000000 c0550420
[  172.517150] 3f00: 00000000 00000002 ee970000 c0a56a3c c0a56a20 00000002 c0a56a3c 00000000
[  172.525726] 3f20: c0a56a3c 0000000a c1580e00 c0a56a20 00000002 c0a56a3c c1580e00 c0a56a20
[  172.534301] 3f40: ef92cbc0 c05173a0 00000001 ef92cbc0 c0576190 c04e3174 20000013 c0517324
[  172.542877] 3f60: ef815c00 ee90b720 c04e3174 c0576190 00000001 ef92cbc0 c04b2f00 ffffffff
[  172.551483] 3f80: 00000058 c0517324 00000000 00000000 ffffffff 00000000 00000000 ffffffff
[  172.560058] 3fa0: 00000058 c04b2de0 00000000 00000000 fee1dead 28121969 01234567 00000000
[  172.568634] 3fc0: 00000000 00000000 ffffffff 00000058 00000000 00000001 400aa000 bea9cf14
[  172.577209] 3fe0: 000ea148 bea9c958 000aa750 40225728 60000010 fee1dead 00000000 00000000
[  172.585784] [<c069bfdc>] (do_raw_spin_unlock+0x50/0xc0) from [<c085a7f8>] (_raw_spin_unlock_irqrestore+0x24/0x44)
[  172.596588] [<c085a7f8>] (_raw_spin_unlock_irqrestore+0x24/0x44) from [<c0761ab4>] (musb_shutdown+0x44/0x88)
[  172.606933] [<c0761ab4>] (musb_shutdown+0x44/0x88) from [<c06e2fd0>] (platform_drv_shutdown+0x14/0x18)
[  172.616699] [<c06e2fd0>] (platform_drv_shutdown+0x14/0x18) from [<c06dea90>] (device_shutdown+0x74/0xb4)
[  172.626647] [<c06dea90>] (device_shutdown+0x74/0xb4) from [<c04fccb4>] (kernel_restart_prepare+0x24/0x38)
[  172.636688] [<c04fccb4>] (kernel_restart_prepare+0x24/0x38) from [<c04fcd04>] (kernel_restart+0xc/0x48)
[  172.646545] [<c04fcd04>] (kernel_restart+0xc/0x48) from [<c04fce44>] (sys_reboot+0xfc/0x1d8)
[  172.655426] [<c04fce44>] (sys_reboot+0xfc/0x1d8) from [<c04b2de0>] (ret_fast_syscall+0x0/0x3c)
[  172.664459] Code: e3c3303f e594200c e593300c e1520003 (0a000002)
[  172.670867] ------------[ cut here ]------------
Signed-off-by: NHema HK <hemahk@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

We are now using our own list_head, so we should
be checking against that, not the gadget driver's
list_head.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Due to the recent changes to musb's glue layers,
we can't compile musb-hdrc as a module - compilation
will break due to undefined symbol musb_debug. In
order to fix that, we need a big re-work of the
debug support on the MUSB driver.

Because that would mean a lot of new code coming
into the -rc series, it's best to defer that to
next merge window and for now just disable module
support for MUSB.

Once we get the refactor of the debugging support
done, we can simply revert this patch and things
will go back to normal again.

Cc: stable@kernel.org # v2.6.38
Signed-off-by: NFelipe Balbi <balbi@ti.com>

"tx_ram" points to io memory.  We can't dereference it directly.  Sparse
complains about this: "drivers/usb/musb/cppi_dma.c:1205:25: warning:
dereference of noderef expression"
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Gcc gives the following warnings:

drivers/usb/musb/cppi_dma.c: In function ‘cppi_next_tx_segment’:
drivers/usb/musb/cppi_dma.c:600: warning: format ‘%x’ expects type ‘unsigned int’, but argument 8 has type ‘dma_addr_t’
drivers/usb/musb/cppi_dma.c: In function ‘cppi_next_rx_segment’:
drivers/usb/musb/cppi_dma.c:822: warning: format ‘%x’ expects type ‘unsigned int’, but argument 9 has type ‘dma_addr_t’
drivers/usb/musb/cppi_dma.c: In function ‘cppi_rx_scan’:
drivers/usb/musb/cppi_dma.c:1042: warning: format ‘%08x’ expects type ‘unsigned int’, but argument 4 has type ‘dma_addr_t’
drivers/usb/musb/cppi_dma.c:1114: warning: format ‘%08x’ expects type ‘unsigned int’, but argument 7 has type ‘dma_addr_t’

dma_addr_t is sometimes 32 bit and sometimes 64.  We normally cast them
to unsigned long long for printk().
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Sparse complains (and rightly so):
drivers/usb/musb/cppi_dma.c:1458:33:
	warning: Using plain integer as NULL pointer
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

We should unlock before returning here.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

musb code checks dma mask before calling dma hooks.
Signed-off-by: NMian Yousaf Kaukab <mian.yousaf.kaukab@stericsson.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

On the completion of tx dma, dma is disabled by clearing MUSB_TXCSR_DMAENAB in
TXCSR. If MUSB_TXCSR_AUTOSET was set in txstate() it will remain set although
it is not needed in PIO mode. Clear it as soon as it is not needed.
Signed-off-by: NMian Yousaf Kaukab <mian.yousaf.kaukab@stericsson.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-2.6-block:
  ide: always ensure that blk_delay_queue() is called if we have pending IO
  block: fix request sorting at unplug
  dm: improve block integrity support
  fs: export empty_aops
  ide: ide_requeue_and_plug() reinstate "always plug" behaviour
  blk-throttle: don't call xchg on bool
  ufs: remove unessecary blk_flush_plug
  block: make the flush insertion use the tail of the dispatch list
  block: get rid of elv_insert() interface
  block: dump request state on seeing a corrupted request completion

On an error path in inotify_init1 a normal user can trigger a double
free of struct user.  This is a regression introduced by a2ae4cc9
("inotify: stop kernel memory leak on file creation failure").

We fix this by making sure that if a group exists the user reference is
dropped when the group is cleaned up.  We should not explictly drop the
reference on error and also drop the reference when the group is cleaned
up.

The new lifetime rules are that an inotify group lives from
inotify_new_group to the last fsnotify_put_group.  Since the struct user
and inotify_devs are directly tied to this lifetime they are only
changed/updated in those two locations.  We get rid of all special
casing of struct user or user->inotify_devs.
Signed-off-by: NEric Paris <eparis@redhat.com>
Cc: stable@kernel.org (2.6.37 and up)
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Just because we are not requeuing a request does not mean that
some aren't pending. So always issue a blk_delay_queue() if
either we are requeueing OR there's pending IO.

This fixes a boot problem for some IDE boxes.
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

Comparison function for list_sort() must be anticommutative,
otherwise it is not sorting in ordinary meaning.

But fortunately list_sort() always check ((*cmp)(priv, a, b) <= 0)
it not distinguish negative and zero, so comparison function can
implement only less-or-equal instead of full three-way comparison.
Signed-off-by: NKonstantin Khlebnikov <khlebnikov@openvz.org>
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

The current block integrity (DIF/DIX) support in DM is verifying that
all devices' integrity profiles match during DM device resume (which
is past the point of no return).  To some degree that is unavoidable
(stacked DM devices force this late checking).  But for most DM
devices (which aren't stacking on other DM devices) the ideal time to
verify all integrity profiles match is during table load.

Introduce the notion of an "initialized" integrity profile: a profile
that was blk_integrity_register()'d with a non-NULL 'blk_integrity'
template.  Add blk_integrity_is_initialized() to allow checking if a
profile was initialized.

Update DM integrity support to:
- check all devices with _initialized_ integrity profiles match
  during table load; uninitialized profiles (e.g. for underlying DM
  device(s) of a stacked DM device) are ignored.
- disallow a table load that would result in an integrity profile that
  conflicts with a DM device's existing (in-use) integrity profile
- avoid clearing an existing integrity profile
- validate all integrity profiles match during resume; but if they
  don't all we can do is report the mismatch (during resume we're past
  the point of no return)
Signed-off-by: NMike Snitzer <snitzer@redhat.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

With the ->sync_page() hook gone, we have a few users that
add their own static address_space_operations without any
functions defined.

fs/inode.c already has an empty_aops that it uses for init
purposes. Lets export that and use it in the places where
an otherwise empty aops was defined.
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

We see stalls if we don't always ensure that the queue gets run
again. Even if rq == NULL, we could have other pending requests
in the queue.
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

xchg does not work portably with smaller than 32bit types.
Signed-off-by: NAndreas Schwab <schwab@linux-m68k.org>
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

We already flush the per-process plugging list when context switching,
so a blk_flush_plug call just before a yield() is not needed.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

It's not a preempt type request, in fact we have to insert it
behind requests that do specify INSERT_FRONT.
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

Merge it with __elv_add_request(), it's pretty pointless to
have a function with only two callers. The main interface
is elv_add_request()/__elv_add_request().
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

Currently we just dump a non-informative 'request botched' message.
Lets actually try and print something sane to help debug issues
around this.
Signed-off-by: NJens Axboe <jaxboe@fusionio.com>

* 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/keithp/linux-2.6:
  drm/i915/lvds: Remove 0xa0 DDC probe for LVDS
  drm/i915/crt: Remove 0xa0 probe for VGA

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: rpckbd - fix a leak of the IRQ during init failure
  Input: wacom - add support for Lenovo tablet ID (0xE6)
  Input: i8042 - downgrade selftest error message to dbg()
  Input: synaptics - fix crash in synaptics_module_init()
  Input: spear-keyboard - fix inverted condition in interrupt handler
  Input: uinput - allow for 0/0 min/max on absolute axes.
  Input: sparse-keymap - report KEY_UNKNOWN for unknown scan codes
  Input: sparse-keymap - report scancodes with key events
  Input: h3600_ts_input - fix a spelling error
  Input: wacom - report resolution for pen devices
  Input: wacom - constify wacom_features for a new missed Bamboo models

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc/pseries: Fix build without CONFIG_HOTPLUG_CPU
  powerpc: Set nr_cpu_ids early and use it to free PACAs
  powerpc/pseries: Don't register global initcall
  powerpc/kexec: Fix mismatched ifdefs for PPC64/SMP.
  edac/mpc85xx: Limit setting/clearing of HID1[RFXE] to e500v1/v2 cores
  powerpc/85xx: Update dts for PCIe memory maps to match u-boot of Px020RDB

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable:
  Btrfs: don't warn in btrfs_add_orphan
  Btrfs: fix free space cache when there are pinned extents and clusters V2
  Btrfs: Fix uninitialized root flags for subvolumes
  btrfs: clear __GFP_FS flag in the space cache inode
  Btrfs: fix memory leak in start_transaction()
  Btrfs: fix memory leak in btrfs_ioctl_start_sync()
  Btrfs: fix subvol_sem leak in btrfs_rename()
  Btrfs: Fix oops for defrag with compression turned on
  Btrfs: fix /proc/mounts info.
  Btrfs: fix compiler warning in file.c

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (27 commits)
  ipv6: Don't pass invalid dst_entry pointer to dst_release().
  mlx4: fix kfree on error path in new_steering_entry()
  tcp: len check is unnecessarily devastating, change to WARN_ON
  sctp: malloc enough room for asconf-ack chunk
  sctp: fix auth_hmacs field's length of struct sctp_cookie
  net: Fix dev dev_ethtool_get_rx_csum() for forced NETIF_F_RXCSUM
  usbnet: use eth%d name for known ethernet devices
  starfire: clean up dma_addr_t size test
  iwlegacy: fix bugs in change_interface
  carl9170: Fix tx aggregation problems with some clients
  iwl3945: disable hw scan by default
  wireless: rt2x00: rt2800usb.c add and identify ids
  iwl3945: do not deprecate software scan
  mac80211: fix aggregation frame release during timeout
  cfg80211: fix BSS double-unlinking (continued)
  cfg80211:: fix possible NULL pointer dereference
  mac80211: fix possible NULL pointer dereference
  mac80211: fix NULL pointer dereference in ieee80211_key_alloc()
  ath9k: fix a chip wakeup related crash in ath9k_start
  mac80211: fix a crash in minstrel_ht in HT mode with no supported MCS rates
  ...

This is a revert of 428d2e82.

This is broken in the same manner as for VGA: trying to write to an
invalid address on the (currently 7-bit) i2c bus.

One notable failure appears to be for MacBooks. The scary part was that
it gave the appearance of working (i.e. reporting the absence of the
panel) on various all-in-one machines with ghost LVDS panels and not
failing for laptops.
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Acked-by: NDave Airlie <airlied@linux.ie>
Signed-off-by: NKeith Packard <keithp@keithp.com>

This is a moral revert of 6ec3d0c0.

Following the fix to reset the GMBUS controller after a NAK, we finally
utilize the 0xa0 probe for a CRT connection. And discover that the code
is broken. Shock.

There are a number of issues, but following a key insight from Dave
Airlie, that 0xA0 is an invalid address on a 7-bit bus (though not if we
were to enable 10-bit addressing), and would look like the EDID port
0x50, it is possible to see where the confusion starts.

In short, a write to 0xA0 is accepted by the GMBUS controller which we
interpreted as meaning the existence of a connection (a slave on the
other end of the wire ACKing the write). That was false.

During testing with a broken GMBUS implementation, which never reset an
earlier NAK, this test always reported a NAK and so we proceeded on to
the next test.
Reported-and-tested-by: NSitsofe Wheeler <sitsofe@yahoo.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=35904Reported-and-tested-by: NRiccardo Magliocchetti <riccardo.magliocchetti@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=32612Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Acked-by: NDave Airlie <airlied@linux.ie>
Signed-off-by: NKeith Packard <keithp@keithp.com>

Signed-off-by: NMatt Evans <matt@ozlabs.au.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Without this, "holes" in the CPU numbering can cause us to
free too many PACAs
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Commit b3df895a "powerpc/kexec: Add support for FSL-BookE"
introduced the original PPC_STD_MMU_64 checks around the function
crash_kexec_wait_realmode().   Then commit c2be0548
"powerpc: Fix default_machine_crash_shutdown #ifdef botch" changed
the ifdef around the calling site to add a check on SMP, but the
ifdef around the function itself was left unchanged, leaving an
unused function for PPC_STD_MMU_64=y and SMP=n

Rather than have two ifdefs that can get out of sync like this,
simply put the corrected conditional around the function and use
a stub to get rid of one set of ifdefs completely.
Signed-off-by: NPaul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

When I moved the orphan adding to btrfs_truncate I missed the fact that during
orphan cleanup we just add the orphan items to the orphan list without going
through btrfs_orphan_add, which results in lots of warnings on mount if you have
any orphan items that need to be truncated.  Just remove this warning since it's
ok, this will allow all of the normal space accounting take place.  Thanks,
Signed-off-by: NJosef Bacik <josef@redhat.com>
Signed-off-by: NChris Mason <chris.mason@oracle.com>

I noticed a huge problem with the free space cache that was presenting
as an early ENOSPC.  Turns out when writing the free space cache out I
forgot to take into account pinned extents and more importantly
clusters.  This would result in us leaking free space everytime we
unmounted the filesystem and remounted it.

I fix this by making sure to check and see if the current block group
has a cluster and writing out any entries that are in the cluster to the
cache, as well as writing any pinned extents we currently have to the
cache since those will be available for us to use the next time the fs
mounts.

This patch also adds a check to the end of load_free_space_cache to make
sure we got the right amount of free space cache, and if not make sure
to clear the cache and re-cache the old fashioned way.
Signed-off-by: NJosef Bacik <josef@redhat.com>
Signed-off-by: NChris Mason <chris.mason@oracle.com>

root_item->flags and root_item->byte_limit are not initialized when
a subvolume is created. This bug is not revealed until we added
readonly snapshot support - now you mount a btrfs filesystem and you
may find the subvolumes in it are readonly.

To work around this problem, we steal a bit from root_item->inode_item->flags,
and use it to indicate if those fields have been properly initialized.
When we read a tree root from disk, we check if the bit is set, and if
not we'll set the flag and initialize the two fields of the root item.
Reported-by: NAndreas Philipp <philipp.andreas@gmail.com>
Signed-off-by: NLi Zefan <lizf@cn.fujitsu.com>
Tested-by: NAndreas Philipp <philipp.andreas@gmail.com>
cc: stable@kernel.org
Signed-off-by: NChris Mason <chris.mason@oracle.com>

the object id of the space cache inode's key is allocated from the relative
root, just like the regular file. So we can't identify space cache inode by
checking the object id of the inode's key, and we have to clear __GFP_FS flag
at the time we look up the space cache inode.
Signed-off-by: NMiao Xie <miaox@cn.fujitsu.com>
Signed-off-by: NLiu Bo <liubo2009@cn.fujitsu.com>
Signed-off-by: NChris Mason <chris.mason@oracle.com>

Free btrfs_trans_handle when join_transaction() fails
in start_transaction()
Signed-off-by: NYoshinori Sano <yoshinori.sano@gmail.com>
Signed-off-by: NChris Mason <chris.mason@oracle.com>