spi/pxa2xx: check status register as well to determine if the device is off

The current interrupt handler calls pm_runtime_suspended() to check if the
device is suspended or not. However, runtime PM status of the device is
only set to suspended once all PM runtime suspend hooks have executed.

In case of Intel Lynxpoint we have the device bound to the ACPI power
domain and its runtime suspend hook will put the device to D3hot (or D3cold
if possible). This means that the device is powered off before its state is
set to runtime suspended. While in this state the device might get an
interrupt that is meant for another device (as the interrupt line is
shared), and because the device is powered off accessing its registers will
return 0xffffffff that the driver misinterprets as an invalid state.

When this happens user will see messages like below on the console:

  pxa2xx-spi INT33C0:00: bad message state in interrupt handler

Fix this by checking the status register for ~0 and returning IRQ_NONE in
that case.

Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
spi: clps711x: Don't call kfree() after spi_master_put/spi_unregister_master

Calling kfree() to clean up the memory obtained from spi_alloc_master() is
wrong as this is done in spi_master_release() when spi_master->dev's refcount
reaches zero.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
cgroup: fix cgroup post-order descendant walk of empty subtree

bd8815a6d8 ("cgroup: make css_for_each_descendant() and friends
include the origin css in the iteration") updated cgroup descendant
iterators to include the origin css; unfortuantely, it forgot to drop
special case handling in css_next_descendant_post() for empty subtree
leading to failure to visit the origin css without any child.

Fix it by dropping the special case handling and always returning the
leftmost descendant on the first iteration.

Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Li Zefan <lizefan@huawei.com>
spi: mpc512x: fix error return code in mpc512x_psc_spi_do_probe()

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Mark Brown <broonie@linaro.org>
spi: fix return value check in dspi_probe()

In case of error, the function devm_ioremap_resource() returns
ERR_PTR() and never returns NULL. The NULL test in the return
value check should be replaced with IS_ERR().

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Mark Brown <broonie@linaro.org>
ASoC: core: Only add platform DAI widgets once.

Currently platform CPU DAI widgets are created in soc_probe_platform and
soc_probe_link_dais. Remove the extra call in soc_probe_link_dais().

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
ASoC: max98095: a couple array underflows

The ->put() function are called from snd_ctl_elem_write() with user
supplied data.  The limit checks here could underflow leading to a
crash.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org
ASoC: ab8500-codec: info leak in anc_status_control_put()

If the user passes an invalid value it leads to an info leak when we
print the error message or it could oops.  This is called with user
supplied data from snd_ctl_elem_write().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org
ASoC: 88pm860x: array overflow in snd_soc_put_volsw_2r_st()

This is called from snd_ctl_elem_write() with user supplied data so we
need to add some bounds checking.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org
ext4: fix performance regression in writeback of random writes

The Linux Kernel Performance project guys have reported that commit
4e7ea81db5 introduces a performance regression for the following fio
workload:

[global]
direct=0
ioengine=mmap
size=1500M
bs=4k
pre_read=1
numjobs=1
overwrite=1
loops=5
runtime=300
group_reporting
invalidate=0
directory=/mnt/
file_service_type=random:36
file_service_type=random:36

[job0]
startdelay=0
rw=randrw
filename=data0/f1:data0/f2

[job1]
startdelay=0
rw=randrw
filename=data0/f2:data0/f1
...

[job7]
startdelay=0
rw=randrw
filename=data0/f2:data0/f1

The culprit of the problem is that after the commit ext4_writepages()
are more aggressive in writing back pages. Thus we have less consecutive
dirty pages resulting in more seeking.

This increased aggressivity is caused by a bug in the condition
terminating ext4_writepages(). We start writing from the beginning of
the file even if we should have terminated ext4_writepages() because
wbc->nr_to_write <= 0.

After fixing the condition the throughput of the fio workload is about 20%
better than before writeback reorganization.

Reported-by: "Yan, Zheng" <zheng.z.yan@intel.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
ASoC: blackfin: Add missing break statement to bf6xx

SNDRV_PCM_FORMAT_S8 isn't supposed to fall through to SNDRV_PCM_FORMAT_S16_LE

Signed-off-by: Valentin Ilie <valentin.ilie@gmail.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
edma: Update author email address

Matt's @ti.com address bounces.  Update the MODULE_AUTHOR information in
edma.c to his Linaro address.

Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Acked-by: Matt Porter <matt.porter@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
dma/Kconfig: Make TI_EDMA select TI_PRIV_EDMA

The TI_EDMA driver unconditionally calls functions provided by the
TI_PRIV_EDMA code, but it doesn't force that to be built-in.  If that isn't
otherwise enabled somewhere, you can get build errors like:

linux-3.12.0-0.rc0.git1.1.fc21.armv7hl/drivers/dma/edma.c:593: undefined reference to `edma_free_slot'
drivers/built-in.o: In function `edma_terminate_all':
linux-3.12.0-0.rc0.git1.1.fc21.armv7hl/drivers/dma/edma.c:169: undefined reference to `edma_stop'
drivers/built-in.o: In function `edma_execute':
linux-3.12.0-0.rc0.git1.1.fc21.armv7hl/drivers/dma/edma.c:122: undefined reference to `edma_write_slot'
linux-3.12.0-0.rc0.git1.1.fc21.armv7hl/drivers/dma/edma.c:149: undefined reference to `edma_link'
linux-3.12.0-0.rc0.git1.1.fc21.armv7hl/drivers/dma/edma.c:152: undefined reference to `edma_start'

Make TI_EDMA select TI_PRIV_EDMA to avoid this.

Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Acked-by: Matt Porter <matt.porter@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
iommu/arm-smmu: fix a signedness bug

Unsigned char is never equal to -1.

Cc: <stable@vger.kernel.org>
Tested-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
iommu/arm-smmu: fix iommu_present() test in init

The extra semi-colon on the end breaks the test.

Cc: <stable@vger.kernel.org>
Tested-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
iommu/arm-smmu: don't enable SMMU device until probing has completed

We currently reset and enable the SMMU before the device has finished
being probed, so if we fail later on (for example, because we couldn't
request a global irq successfully) then we will leave the device in an
active state.

This patch delays the reset and enabling of the SMMU hardware until
probing has completed.

Cc: <stable@vger.kernel.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
jfs: fix error path in ialloc

If insert_inode_locked() fails, we shouldn't be calling
unlock_new_inode().

Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Tested-by: Michael L. Semon <mlsemon35@gmail.com>
Cc: stable@vger.kernel.org
usb: musb: fix otg default state

Right after the musb_hdrc driver is loaded, the otg default state
is a_idle, and Mode=Host, which are set by musb_host_setup().

This causes the following kernel message during musb gadget
enumeration.

	CAUTION: musb: Babble Interrupt Occurred

This patch sets the otg default state to b_idle, and its Mode to
Peripheral.

It has been validated on TI AM335x GP EVM USB0 port with g_zero.

Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
fuse: wait for writeback in fuse_file_fallocate()

The patch fixes a race between mmap-ed write and fallocate(PUNCH_HOLE):

1) An user makes a page dirty via mmap-ed write.
2) The user performs fallocate(2) with mode == PUNCH_HOLE|KEEP_SIZE
   and <offset, size> covering the page.
3) Before truncate_pagecache_range call from fuse_file_fallocate,
   the page goes to write-back. The page is fully processed by fuse_writepage
   (including end_page_writeback on the page), but fuse_flush_writepages did
   nothing because fi->writectr < 0.
4) truncate_pagecache_range is called and fuse_file_fallocate is finishing
   by calling fuse_release_nowrite. The latter triggers processing queued
   write-back request which will write stale data to the hole soon.

Changed in v2 (thanks to Brian for suggestion):
 - Do not truncate page cache until FUSE_FALLOCATE succeeded. Otherwise,
   we can end up in returning -ENOTSUPP while user data is already punched
   from page cache. Use filemap_write_and_wait_range() instead.
Changed in v3 (thanks to Miklos for suggestion):
 - fuse_wait_on_writeback() is prone to livelocks; use fuse_set_nowrite()
   instead. So far as we need a dirty-page barrier only, fuse_sync_writes()
   should be enough.
 - rebased to for-linus branch of fuse.git

Signed-off-by: Maxim Patlasov <mpatlasov@parallels.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Cc: stable@vger.kernel.org
fuse: fix fallocate vs. ftruncate race

A former patch introducing FUSE_I_SIZE_UNSTABLE flag provided detailed
description of races between ftruncate and anyone who can extend i_size:

> 1. As in the previous scenario fuse_dentry_revalidate() discovered that i_size
> changed (due to our own fuse_do_setattr()) and is going to call
> truncate_pagecache() for some  'new_size' it believes valid right now. But by
> the time that particular truncate_pagecache() is called ...
> 2. fuse_do_setattr() returns (either having called truncate_pagecache() or
> not -- it doesn't matter).
> 3. The file is extended either by write(2) or ftruncate(2) or fallocate(2).
> 4. mmap-ed write makes a page in the extended region dirty.

This patch adds necessary bits to fuse_file_fallocate() to protect from that
race.

Signed-off-by: Maxim Patlasov <mpatlasov@parallels.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Cc: stable@vger.kernel.org