By default these clocks are children of pll_m, but in downstream kernels
they are reparented to pll_c. While at it, decrease their frequencies to
300 MHz because the defaults aren't in the specified range.

gr2d can reportedly run at much higher frequencies, but 300 MHz works
and is a more conservative default.
Signed-off-by: NThierry Reding <thierry.reding@avionic-design.de>
Acked-by: NMike Turquette <mturquette@linaro.org>
Acked-By: NPeter De Schrijver <pdeschrijver@nvidia.com>
Signed-off-by: NStephen Warren <swarren@nvidia.com>

The tegra_periph_reset_assert() and tegra_periph_reset_deassert()
functions can be used by drivers to reset peripherals. In order to allow
such drivers to be built as modules, export the functions.

Note that this restores the status quo as the functions were exported
before the move to the drivers/clk tree.
Signed-off-by: NThierry Reding <thierry.reding@avionic-design.de>
Acked-by: NMike Turquette <mturquette@linaro.org>
Signed-off-by: NStephen Warren <swarren@nvidia.com>

The parameter name should be "gate", not "periph".  This worked, however,
because it happens that everywhere periph_clk_to_bit is called, "gate" was
in the local scope.
Signed-off-by: NYen Lin <yelin@nvidia.com>
Signed-off-by: NAndrew Chew <achew@nvidia.com>
Reviewed-by: NThierry Reding <thierry.reding@avionic-design.de>
Reviewed-by: NPrashant Gaikwad <pgaikwad@nvidia.com>
Acked-by: NPeter De Schrijver <pdeschrijver@nvidia.com>
Acked-by: NMike Turquette <mturquette@linaro.org>
Signed-off-by: NStephen Warren <swarren@nvidia.com>

After the patch series for system suspending support, tegra_idle_lp2_last()
no longer uses its parameters cpu_on_time or cpu_off_time, so remove them.
Signed-off-by: NJoseph Lo <josephl@nvidia.com>
Signed-off-by: NStephen Warren <swarren@nvidia.com>

Adding suspend to RAM support for Tegra platform. There are three suspend
mode for Tegra. The difference were below.

* LP2: CPU voltage off
* LP1: CPU voltage off, DRAM in self-refresh
* LP0: CPU + Core voltage off, DRAM in self-refresh

After this patch, the LP2 suspend mode will be supported.
Signed-off-by: NJoseph Lo <josephl@nvidia.com>
Signed-off-by: NStephen Warren <swarren@nvidia.com>

The PMC mostly controls the entry and exit of the system from different
sleep modes. Different platform or system may have different configurations.
The power management configurations of PMC is represented as some properties.
The system needs to define the properties when the system supports deep sleep
mode (i.e. suspend).

Cc: Grant Likely <grant.likely@secretlab.ca>
Cc: Rob Herring <rob.herring@calxeda.com>
Cc: devicetree-discuss@lists.ozlabs.org
Signed-off-by: NJoseph Lo <josephl@nvidia.com>
Signed-off-by: NStephen Warren <swarren@nvidia.com>

Add the wake up handling for legacy irq controller, and using
IRQCHIP_MASK_ON_SUSPEND for wake irq handling.

Based on the work by:
Varun Wadekar <vwadekar@nvidia.com>
Signed-off-by: NJoseph Lo <josephl@nvidia.com>
Signed-off-by: NStephen Warren <swarren@nvidia.com>

This patch add the gpio wakeup source handling for the Tegra platform. It
was be done by enabling the irq for the gpio in the gpio controller and
enabling the bank irq of the gpio in the Tegra legacy irq controller when
the system going to suspend.

Based on the work by:
Varun Wadekar <vwadekar@nvidia.com>

Cc: Grant Likely <grant.likely@secretlab.ca>
Cc: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: NJoseph Lo <josephl@nvidia.com>
Acked-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NStephen Warren <swarren@nvidia.com>

The CPU power timer set up function was related to PMC register. Now moving
it to PMC driver. And it also help to clean up the PM related code later.

The timer was calculated based on the input clock of PMC. In this patch, we
also get the clock from DT.
Signed-off-by: NJoseph Lo <josephl@nvidia.com>
Signed-off-by: NStephen Warren <swarren@nvidia.com>

Adding the bindings of the clock source of PMC in DT.
Signed-off-by: NJoseph Lo <josephl@nvidia.com>
Signed-off-by: NStephen Warren <swarren@nvidia.com>

Reentrancy into the clock framework is necessary for clock operations
that result in nested calls to the clk api.  A common example is a clock
that is prepared via an i2c transaction, such as a clock inside of a
discrete audio chip or a power management IC.  The i2c subsystem itself
will use the clk api resulting in a deadlock:

clk_prepare(audio_clk)
	i2c_transfer(..)
		clk_prepare(i2c_controller_clk)

The ability to reenter the clock framework prevents this deadlock.

Other use cases exist such as allowing .set_rate callbacks to call
clk_set_parent to achieve the best rate, or to save power in certain
configurations.  Yet another example is performing pinctrl operations
from a clk_ops callback.  Calls into the pinctrl subsystem may call
clk_{un}prepare on an unrelated clock.  Allowing for nested calls to
reenter the clock framework enables both of these use cases.

Reentrancy is implemented by two global pointers that track the owner
currently holding a global lock.  One pointer tracks the owner during
sleepable, mutex-protected operations and the other one tracks the owner
during non-interruptible, spinlock-protected operations.

When the clk framework is entered we try to hold the global lock.  If it
is held we compare the current task against the current owner; a match
implies a nested call and we reenter.  If the values do not match then
we block on the lock until it is released.
Signed-off-by: NMike Turquette <mturquette@linaro.org>
Cc: Rajagopal Venkat <rajagopal.venkat@linaro.org>
Cc: David Brown <davidb@codeaurora.org>
Tested-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: NThomas Gleixner <tglx@linutronix.de>
Reviewed-by: NUlf Hansson <ulf.hansson@linaro.org>

Create locking helpers for the global mutex and global spinlock.  The
definitions of these helpers will be expanded upon in the next patch
which introduces reentrancy into the locking scheme.
Signed-off-by: NMike Turquette <mturquette@linaro.org>
Cc: Rajagopal Venkat <rajagopal.venkat@linaro.org>
Cc: David Brown <davidb@codeaurora.org>
Tested-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: NThomas Gleixner <tglx@linutronix.de>
Reviewed-by: NUlf Hansson <ulf.hansson@linaro.org>

Include zynq clk header where init function is declared.

It removes this sparse warning:
drivers/clk/clk-zynq.c:373:13: warning: symbol
'xilinx_zynq_clocks_init' was not declared. Should it be static?
Signed-off-by: NMichal Simek <michal.simek@xilinx.com>
Signed-off-by: NMike Turquette <mturquette@linaro.org>

During the introduction of the Allwinner SoC platforms, sunxi was
initially meant as a generic name for all the variants of the Allwinner
SoC.

It was ok at the time of the support of only the A10 and A13 that
look pretty much the same; but it's beginning to be troublesome with
the future addition of the Allwinner A31 (sun6i) that is quite
different, and would introduce some weird logic, where sunxi would
actually mean in some case sun4i and sun5i but without sun6i...

Moreover, it makes the compatible strings naming scheme not consistent
with other architectures, where usually for this kind of compability, we
just use the oldest SoC name that has this IP, so let's do just this.
Signed-off-by: NEmilio López <emilio@elopez.com.ar>
Signed-off-by: NMike Turquette <mturquette@linaro.org>

This patch contains useful bits of information about the sunxi clocks
that may help and/or be interesting for current and future developers.
Signed-off-by: NEmilio López <emilio@elopez.com.ar>
Acked-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: NMike Turquette <mturquette@linaro.org>

This commit implements the base CPU clocks for sunxi devices. It has
been tested using a slightly modified cpufreq driver from the
linux-sunxi 3.0 tree.

Additionally, document the new bindings introduced by this patch.

Idling:
    / # cat /sys/kernel/debug/clk/clk_summary
       clock                        enable_cnt  prepare_cnt  rate
    ---------------------------------------------------------------------
     osc32k                         0           0            32768
     osc24M_fixed                   0           0            24000000
        osc24M                      0           0            24000000
           apb1_mux                 0           0            24000000
              apb1                  0           0            24000000
           pll1                     0           0            60000000
              cpu                   0           0            60000000
                 axi                0           0            60000000
                    ahb             0           0            60000000
                       apb0         0           0            30000000
     dummy                          0           0            0

After "yes >/dev/null &":
    / # cat /sys/kernel/debug/clk/clk_summary
       clock                        enable_cnt  prepare_cnt  rate
    ---------------------------------------------------------------------
     osc32k                         0           0            32768
     osc24M_fixed                   0           0            24000000
        osc24M                      0           0            24000000
           apb1_mux                 0           0            24000000
              apb1                  0           0            24000000
           pll1                     0           0            1008000000
              cpu                   0           0            1008000000
                 axi                0           0            336000000
                    ahb             0           0            168000000
                       apb0         0           0            84000000
     dummy                          0           0            0
Signed-off-by: NEmilio López <emilio@elopez.com.ar>
Acked-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: NMike Turquette <mturquette@linaro.org>

In clk_reg_prcmu(), clk->hw.init field is assigned with a
reference local to clk_reg_prcmu() function.

This patch replaces references to clk->hw.init with calls
to __clk_get_name when called after clock registration.

This patch applies on top of v3.9-rc4.
Signed-off-by: NMaxime Coquelin <maxime.coquelin@st.com>
Acked-by: NUlf Hansson <ulf.hansson@linaro.org>
Signed-off-by: NMike Turquette <mturquette@linaro.org>
[mturquette@linaro.org: resolved trivial merge issues]

Commit ce4f3313 (clk: add table lookup to mux) caused the following build
error on imx_v4_v5_defconfig/imx_v6_v7_defconfig:

arch/arm/mach-imx/clk-busy.c:172:11: error: 'struct clk_mux' has no member named 'width'

Fix it by passing the 'mask' field.
Signed-off-by: NFabio Estevam <fabio.estevam@freescale.com>
Acked-by: NPeter De Schrijver <pdeschrijver@nvidia.com>
Signed-off-by: NMike Turquette <mturquette@linaro.org>
[mturquette@linaro.org: shortened $SUBJECT line]

Not all clocks are required to be decomposed into basic clock
types but at the same time want to use the functionality
provided by these basic clock types instead of duplicating.

For example, Tegra SoC has ~100 clocks which can be decomposed
into Mux -> Div -> Gate clock types making the clock count to
~300. Also, parent change operation can not be performed on gate
clock which forces to use mux clock in driver if want to change
the parent.

Instead aggregate the basic clock types functionality into one
clock and just use this clock for all operations. This clock
type re-uses the functionality of basic clock types and not
limited to basic clock types but any hardware-specific
implementation.
Signed-off-by: NPrashant Gaikwad <pgaikwad@nvidia.com>
Signed-off-by: NMike Turquette <mturquette@linaro.org>

Pull SCSI target fixes from Nicholas Bellinger:
 "These are mostly minor fixes this time around.  The iscsi-target CHAP
  big-endian bugfix and bump FD_MAX_SECTORS=2048 default patch to allow
  1MB sized I/Os for FILEIO backends on >= v3.5 code are both CC'ed to
  stable.

  Also, there is a persistent reservations regression that has recently
  been reported for >= v3.8.x code, that is currently being tracked down
  for v3.9."

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  target/pscsi: Reject cross page boundary case in pscsi_map_sg
  target/file: Bump FD_MAX_SECTORS to 2048 to handle 1M sized I/Os
  tcm_vhost: Flush vhost_work in vhost_scsi_flush()
  tcm_vhost: Add missed lock in vhost_scsi_clear_endpoint()
  target: fix possible memory leak in core_tpg_register()
  target/iscsi: Fix mutual CHAP auth on big-endian arches
  target_core_sbc: use noop for SYNCHRONIZE_CACHE

Pull md fixes from NeilBrown:
 "A few bugfixes for md

   - recent regressions in raid5
   - recent regressions in dmraid
   - a few instances of CONFIG_MULTICORE_RAID456 linger

  Several tagged for -stable"

* tag 'md-3.9-fixes' of git://neil.brown.name/md:
  md: remove CONFIG_MULTICORE_RAID456 entirely
  md/raid5: ensure sync and DISCARD don't happen at the same time.
  MD: Prevent sysfs operations on uninitialized kobjects
  MD RAID5: Avoid accessing gendisk or queue structs when not available
  md/raid5: schedule_construction should abort if nothing to do.

Pull libata updates from Jeff Garzik:
 "Simple stuff.  See one-line summaries."

* tag 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  pata_samsung_cf: use module_platform_driver_probe()
  [libata] Avoid specialized TLA's in ZPODD's Kconfig
  libata-acpi.c: fix copy and paste mistake in ata_acpi_register_power_resource
  sata_fsl: Remove redundant NULL check before kfree
  ahci: Add Device IDs for Intel Wellsburg PCH
  ata_piix: Add MODULE_PARM_DESC to prefer_ms_hyperv

Pull i2c fixes from Wolfram Sang:
 "One bugfix for the tegra driver.  Two updates regarding email
  addresses and MAINTAINERS which I like to have up-to-date so people
  can be reached immediately.  While we are here, there is on PCI_ID
  addition."

* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  MAINTAINERS: add maintainer entry for atmel i2c driver
  i2c: Fix my e-mail address in drivers and documentation
  i2c: iSMT: add Intel Avoton DeviceIDs
  i2c: tegra: check the clk_prepare_enable() return value

Pull watchdog fixes from Wim Van Sebroeck:
 "Fix a boot issues and correct the AcpiMmioSel bitmask in the
  sp5100_tco watchdog device driver"

* git://www.linux-watchdog.org/linux-watchdog:
  watchdog: sp5100_tco: Set the AcpiMmioSel bitmask value to 1 instead of 2
  watchdog: sp5100_tco: Remove code that may cause a boot failure

When KMS has parsed an EDID "detailed timing", it leaves the frame rate
zeroed.  Consecutive (debug-) output of that mode thus yields 0 for
vsync.  This simple fix also speeds up future invocations of
drm_mode_vrefresh().

While it is debatable whether this qualifies as a -stable fix I'd apply
it for consistency's sake; drm_helper_probe_single_connector_modes()
does the same thing already for all probed modes.

Cc: stable@vger.kernel.org
Signed-off-by: NTorsten Duwe <duwe@lst.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

EDID spreads some values across multiple bytes; bit-fiddling is needed
to retrieve these.  The current code to parse "detailed timings" has a
cut&paste error that results in a vsync offset of at most 15 lines
instead of 63.

See

   http://en.wikipedia.org/wiki/EDID

and in the "EDID Detailed Timing Descriptor" see bytes 10+11 show why
that needs to be a left shift.

Cc: stable@vger.kernel.org
Signed-off-by: NTorsten Duwe <duwe@lst.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Pull NVMe driver update from Matthew Wilcox:
 "These patches have mostly been baking for a few months; sorry I didn't
  get them in during the merge window.  They're all bug fixes, except
  for the addition of the SMART log and the addition to MAINTAINERS."

* git://git.infradead.org/users/willy/linux-nvme:
  NVMe: Add namespaces with no LBA range feature
  MAINTAINERS: Add entry for the NVMe driver
  NVMe: Initialize iod nents to 0
  NVMe: Define SMART log
  NVMe: Add result to nvme_get_features
  NVMe: Set result from user admin command
  NVMe: End queued bio requests when freeing queue
  NVMe: Free cmdid on nvme_submit_bio error

Merge misc fixes from Andrew Morton.

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  mqueue: sys_mq_open: do not call mnt_drop_write() if read-only
  mm/hotplug: only free wait_table if it's allocated by vmalloc
  dma-debug: update DMA debug API to better handle multiple mappings of a buffer
  dma-debug: fix locking bug in check_unmap()
  drivers/rtc/rtc-at91rm9200.c: use a variable for storing IMR
  drivers/video/ep93xx-fb.c: include <linux/io.h> for devm_ioremap()
  drivers/rtc/rtc-da9052.c: fix for rtc device registration
  mm: zone_end_pfn is too small
  poweroff: change orderly_poweroff() to use schedule_work()
  mm/hugetlb: fix total hugetlbfs pages count when using memory overcommit accouting
  printk: Provide a wake_up_klogd() off-case
  irq_work.h: fix warning when CONFIG_IRQ_WORK=n

mnt_drop_write() must be called only if mnt_want_write() succeeded,
otherwise the mnt_writers counter will diverge.

mnt_writers counters are used to check if remounting FS as read-only is
OK, so after an extra mnt_drop_write() call, it would be impossible to
remount mqueue FS as read-only.  Besides, on umount a warning would be
printed like this one:

  =====================================
  [ BUG: bad unlock balance detected! ]
  3.9.0-rc3 #5 Not tainted
  -------------------------------------
  a.out/12486 is trying to release lock (sb_writers) at:
  mnt_drop_write+0x1f/0x30
  but there are no more locks to release!
Signed-off-by: NVladimir Davydov <vdavydov@parallels.com>
Cc: Doug Ledford <dledford@redhat.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

zone->wait_table may be allocated from bootmem, it can not be freed.
Signed-off-by: NJianguo Wu <wujianguo@huawei.com>
Reviewed-by: NTang Chen <tangchen@cn.fujitsu.com>
Cc: Tang Chen <tangchen@cn.fujitsu.com>
Cc: Jiang Liu <jiang.liu@huawei.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

There were reports of the igb driver unmapping buffers without calling
dma_mapping_error.  On closer inspection issues were found in the DMA
debug API and how it handled multiple mappings of the same buffer.

The issue I found is the fact that the debug_dma_mapping_error would
only set the map_err_type to MAP_ERR_CHECKED in the case that the was
only one match for device and device address.  However in the case of
non-IOMMU, multiple addresses existed and as a result it was not setting
this field once a second mapping was instantiated.  I have resolved this
by changing the search so that it instead will now set MAP_ERR_CHECKED
on the first buffer that matches the device and DMA address that is
currently in the state MAP_ERR_NOT_CHECKED.

A secondary side effect of this patch is that in the case of multiple
buffers using the same address only the last mapping will have a valid
map_err_type.  The previous mappings will all end up with map_err_type
set to MAP_ERR_CHECKED because of the dma_mapping_error call in
debug_dma_map_page.  However this behavior may be preferable as it means
you will likely only see one real error per multi-mapped buffer, versus
the current behavior of multiple false errors mer multi-mapped buffer.
Signed-off-by: NAlexander Duyck <alexander.h.duyck@intel.com>
Cc: Joerg Roedel <joro@8bytes.org>
Reviewed-by: NShuah Khan <shuah.khan@hp.com>
Tested-by: NShuah Khan <shuah.khan@hp.com>
Cc: Jakub Kicinski <kubakici@wp.pl>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

In check_unmap() it is possible to get into a dead-locked state if
dma_mapping_error is called.  The problem is that the bucket is locked in
check_unmap, and locked again by debug_dma_mapping_error which is called
by dma_mapping_error.  To resolve that we must release the lock on the
bucket before making the call to dma_mapping_error.

[akpm@linux-foundation.org: restore 80-col trickery to be consistent with the rest of the file]
Signed-off-by: NAlexander Duyck <alexander.h.duyck@intel.com>
Cc: Joerg Roedel <joro@8bytes.org>
Reviewed-by: NShuah Khan <shuah.khan@hp.com>
Tested-by: NShuah Khan <shuah.khan@hp.com>
Cc: Jakub Kicinski <kubakici@wp.pl>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

On some revisions of AT91 SoCs, the RTC IMR register is not working.
Instead of elaborating a workaround for that specific SoC or IP version,
we simply use a software variable to store the Interrupt Mask Register
and modify it for each enabling/disabling of an interrupt.  The overhead
of this is negligible anyway.

The interrupt mask register (IMR) for the RTC is broken on the AT91SAM9x5
sub-family of SoCs (good overview of the members here:
http://www.eewiki.net/display/linuxonarm/AT91SAM9x5 ).  The "user visible
effect" is the RTC doesn't work.

That sub-family is less than two years old and only has devicetree (DT)
support and came online circa lk 3.7 .  The dust is yet to settle on the
DT stuff at least for AT91 SoCs (translation: lots of stuff is still
broken, so much that it is hard to know where to start).

The fix in the patch is pretty simple: just shadow the silicon IMR
register with a variable in the driver.  Some older SoCs (pre-DT) use the
the rtc-at91rm9200 driver (e.g.  obviously the AT91RM9200) and they should
not be impacted by the change.  There shouldn't be a large volume of
interrupts associated with a RTC.
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Reported-by: NDouglas Gilbert <dgilbert@interlog.com>
Cc: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Cc: Ludovic Desroches <ludovic.desroches@atmel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Commit be867814 ("drivers/video/ep93xx-fb.c: use devm_ functions")
introduced a build error:

  drivers/video/ep93xx-fb.c: In function 'ep93xxfb_probe':
  drivers/video/ep93xx-fb.c:532: error: implicit declaration of function 'devm_ioremap'
  drivers/video/ep93xx-fb.c:533: warning: assignment makes pointer from integer without a cast

Include <linux/io.h> to pickup the declaration of 'devm_ioremap'.
Signed-off-by: NH Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Acked-by: NRyan Mallon <rmallon@gmail.com>
Cc: Damien Cassou <damien.cassou@lifl.fr>
Cc: <stable@vger.kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Add support for the virtual irq since now MFD only handles virtual irq
Without this patch rtc device will fail in registration.

(akpm: Ashish has a different version whcih will be needed for 3.8.x and
earlier kernels)
Signed-off-by: NAshish <ashish.jangam@kpitcummins.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Booting with 32 TBytes memory hits BUG at mm/page_alloc.c:552! (output
below).

The key hint is "page 4294967296 outside zone".
4294967296 = 0x100000000 (bit 32 is set).

The problem is in include/linux/mmzone.h:

  530 static inline unsigned zone_end_pfn(const struct zone *zone)
  531 {
  532         return zone->zone_start_pfn + zone->spanned_pages;
  533 }

zone_end_pfn is "unsigned" (32 bits).  Changing it to "unsigned long"
(64 bits) fixes the problem.

zone_end_pfn() was added recently in commit 108bcc96 ("mm: add & use
zone_end_pfn() and zone_spans_pfn()")

Output from the failure.

  No AGP bridge found
  page 4294967296 outside zone [ 4294967296 - 4327469056 ]
  ------------[ cut here ]------------
  kernel BUG at mm/page_alloc.c:552!
  invalid opcode: 0000 [#1] SMP
  Modules linked in:
  CPU 0
  Pid: 0, comm: swapper Not tainted 3.9.0-rc2.dtp+ #10
  RIP: free_one_page+0x382/0x430
  Process swapper (pid: 0, threadinfo ffffffff81942000, task ffffffff81955420)
  Call Trace:
    __free_pages_ok+0x96/0xb0
    __free_pages+0x25/0x50
    __free_pages_bootmem+0x8a/0x8c
    __free_memory_core+0xea/0x131
    free_low_memory_core_early+0x4a/0x98
    free_all_bootmem+0x45/0x47
    mem_init+0x7b/0x14c
    start_kernel+0x216/0x433
    x86_64_start_reservations+0x2a/0x2c
    x86_64_start_kernel+0x144/0x153
  Code: 89 f1 ba 01 00 00 00 31 f6 d3 e2 4c 89 ef e8 66 a4 01 00 e9 2c fe ff ff 0f 0b eb fe 0f 0b 66 66 2e 0f 1f 84 00 00 00 00 00 eb f3 <0f> 0b eb fe 0f 0b 0f 1f 84 00 00 00 00 00 eb f6 0f 0b eb fe 49
Signed-off-by: NRuss Anderson <rja@sgi.com>
Reported-by: NGeorge Beshers <gbeshers@sgi.com>
Acked-by: NHedi Berriche <hedi@sgi.com>
Cc: Cody P Schafer <cody@linux.vnet.ibm.com>
Cc: Michal Hocko <mhocko@suse.cz>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

David said:

    Commit 6c0c0d4d ("poweroff: fix bug in orderly_poweroff()")
    apparently fixes one bug in orderly_poweroff(), but introduces
    another.  The comments on orderly_poweroff() claim it can be called
    from any context - and indeed we call it from interrupt context in
    arch/powerpc/platforms/pseries/ras.c for example.  But since that
    commit this is no longer safe, since call_usermodehelper_fns() is not
    safe in interrupt context without the UMH_NO_WAIT option.

orderly_poweroff() can be used from any context but UMH_WAIT_EXEC is
sleepable.  Move the "force" logic into __orderly_poweroff() and change
orderly_poweroff() to use the global poweroff_work which simply calls
__orderly_poweroff().

While at it, remove the unneeded "int argc" and change argv_split() to
use GFP_KERNEL.

We use the global "bool poweroff_force" to pass the argument, this can
obviously affect the previous request if it is pending/running.  So we
only allow the "false => true" transition assuming that the pending
"true" should succeed anyway.  If schedule_work() fails after that we
know that work->func() was not called yet, it must see the new value.

This means that orderly_poweroff() becomes async even if we do not run
the command and always succeeds, schedule_work() can only fail if the
work is already pending.  We can export __orderly_poweroff() and change
the non-atomic callers which want the old semantics.
Signed-off-by: NOleg Nesterov <oleg@redhat.com>
Reported-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Reported-by: NDavid Gibson <david@gibson.dropbear.id.au>
Cc: Lucas De Marchi <lucas.demarchi@profusion.mobi>
Cc: Feng Hong <hongfeng@marvell.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>