1. 25 Mar, 2013 14 commits
    • Alan Stern's avatar
      USB: EHCI: split needs_rescan into two flags · 7bc782d7
      Alan Stern authored
      This patch (as1662) does some more QH-related cleanup in ehci-hcd.
      The qh->needs_rescan flag is currently used for two different
      purposes; the patch replaces it with two separate flags for greater
      clarity: qh->dequeue_during_giveback indicates that a completion
      handler dequeued an URB (implying that a rescan is needed), and
      qh->exception indicates that the QH is in an exceptional state
      requiring an unlink (either it encountered an I/O error or an unlink
      was requested).
      
      The new flags get set where the dequeue, exception, or unlink request
      occurred, rather than where the unlink is started.  This is so that in
      the future, if we need to, we will be able to tell apart unlinks that
      truly were required from those that were carried out merely because
      the QH wasn't being used.
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7bc782d7
    • Alan Stern's avatar
      USB: EHCI: change return value of qh_completions() · 79bcf7b0
      Alan Stern authored
      This patch (as1658) cleans up the usage of qh_completions() in
      ehci-hcd.  Currently the function's return value indicates whether any
      URBs were given back; the idea was that the caller can scan the QH
      over again to handle any URBs that were dequeued by a completion
      handler.  This is not necessary; when qh_completions() is ready to
      give back dequeued URBs, it does its own rescanning.
      
      Therefore the new return value will be a flag indicating whether the
      caller needs to unlink the QH.  This is more convenient than forcing
      the caller to check qh->needs_rescan, and it makes a lot more sense --
      why should "needs_rescan" imply that an unlink is needed?  The callers
      are also changed to remove the unneeded rescans.
      
      Lastly, the check for whether qh->qtd_list is non-empty is removed
      from the start of qh_completions().  Two of the callers have to make
      this test anyway, so the same test can simply be added to the other
      two callers.
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      79bcf7b0
    • Alan Stern's avatar
      USB: EHCI: changes related to qh_refresh() · c1fdb68e
      Alan Stern authored
      This patch (as1638) makes several changes to the ehci-hcd driver, all
      related to the qh_refresh() function.  This function must be called
      whenever an idle QH gets linked back into either the async or the
      periodic schedule.
      
      	Change a BUG_ON() in the qh_update routine to a WARN_ON().
      	Since this code runs in atomic context, a BUG_ON() would
      	immediately freeze the whole system.
      
      	Remove two unneeded calls to qh_refresh(), one when a QH is
      	initialized and one when a QH becomes idle.  Adjust the
      	adjacent comments accordingly.
      
      	Move the qh_refresh() and qh_link_periodic() calls for new
      	interrupt URBs to after the new TDs have been added.
      
      	As a result of the previous two changes, qh_refresh() is never
      	called when the qtd_list is empty.  The corresponding check in
      	qh_refresh() can be removed, along with an indentation level.
      
      These changes should not cause any alteration of behavior.
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c1fdb68e
    • Du Xing's avatar
      USB: usb-skeleton.c: fix blocked forever in skel_read · c79041a4
      Du Xing authored
      In skel_read,the reader blocked in wait_for_completion before submit
      bulk in urb.
      Using processed_urb is for retaining the completion in the case that
      previous interruptible wait in skel_read was interrupted and complete
      before next skel_read.  Replacing completion with waitqueue can avoid
      working around the counting nature of completions
      and fix the bug.
      
      Signed-off-by: Du Xing duxing2007@gmail.com
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c79041a4
    • Bjørn Mork's avatar
      USB: cdc-wdm: implement IOCTL_WDM_MAX_COMMAND · 3edce1cf
      Bjørn Mork authored
      Userspace applications need to know the maximum supported message
      size.
      
      The cdc-wdm driver translates between a character device stream
      and a message based protocol.  Each message is transported as a
      usb control message with no further encapsulation or syncronization.
      Each read or write on the character device should translate to
      exactly one usb control message to ensure that message boundaries
      are kept intact.  That means that the userspace application must
      know the maximum message size supported by the device and driver,
      making this size a vital part of the cdc-wdm character device API.
      
      CDC WDM and CDC MBIM functions export the maximum supported
      message size through CDC functional descriptors.  The cdc-wdm and
      cdc_mbim drivers will parse these descriptors and use the value
      chosen by the device.  The only current way for a userspace
      application to retrive the value is by duplicating the descriptor
      parsing. This is an unnecessary complex task, and application
      writers are likely to postpone it, using a fixed value and adding
      a "todo" item.
      
      QMI functions have no way to tell the host what message size they
      support.  The qmi_wwan driver use a fixed value based on protocol
      recommendations and observed device behaviour.  Userspace
      applications must know and hard code the same value.  This scheme
      will break if we ever encounter a QMI device needing a device
      specific message size quirk.  We are currently unable to support
      such a device because using a non default size would break the
      implicit userspace API.
      
      The message size is currently a hidden attribute of the cdc-wdm
      userspace API.  Retrieving it is unnecessarily complex, increasing
      the possibility of drivers and applications using different limits.
      The resulting errors are hard to debug, and can only be replicated
      on identical hardware.
      
      Exporting the maximum message size from the driver simplifies the
      task for the userspace application, and creates a unified
      information source independent of device and function class. It also
      serves to document that the message size is part of the cdc-wdm
      userspace API.
      
      This proposed API extension has been presented for the authors of
      userspace applications and libraries using the current API: libmbim,
      libqmi, uqmi, oFono and ModemManager.  The replies were:
      
      Aleksander Morgado:
       "We do really need max message size for MBIM; and as you say, it may be
        good to have the max message size info also for QMI, so the new ioctl
        seems a good addition. So +1 from my side, for what it's worth."
      
      Dan Williams:
       "Yeah, +1 here.  I'd prefer the sysfs file, but the fact that that
        doesn't work for fd passing pretty much kills it."
      
      No negative replies are so far received.
      
      Cc: Aleksander Morgado <aleksander@lanedo.com>
      Cc: Dan Williams <dcbw@redhat.com>
      Signed-off-by: default avatarBjørn Mork <bjorn@mork.no>
      Acked-by: default avatarOliver Neukum <oliver@neukum.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      3edce1cf
    • David Linares's avatar
      USB: hub: Avoid NULL pointer dereference when hub doesn't have any ports · 769d7368
      David Linares authored
      Return an error if hub->descriptor->bNbrPorts==0. Without this additional
      check, we can end up doing a "hub->ports = kzalloc(0, GFP_KERNEL)".
      This hub->ports pointer will therefore be non-NULL and will be used.
      Example of dmesg:
         INIT: usb 1-1: New USB device found, idVendor=0424, idProduct=2512
         usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
         hub 1-1:1.0: USB hub found
         version 2.86 bootinghub 1-1:1.0: 0 ports detected
         Unable to handle kernel NULL pointer dereference at virtual address 00000010
      Signed-off-by: default avatarDavid Linares <dlinares.linux@gmail.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      769d7368
    • Ming Lei's avatar
      usbnet: smsc75xx: don't recover device if suspend fails in system sleep · 5410a473
      Ming Lei authored
      If suspend callback fails in system sleep context, usb core will
      ignore the failure and let system sleep go ahead further, so
      this patch doesn't recover device under this situation.
      
      Also add comments on this case.
      Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
      Cc: Steve Glendinning <steve.glendinning@shawell.net>
      Signed-off-by: default avatarMing Lei <ming.lei@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5410a473
    • Ming Lei's avatar
      usbnet: smsc95xx: don't recover device if suspend fails in system sleep · 0d41be53
      Ming Lei authored
      If suspend callback fails in system sleep context, usb core will
      ignore the failure and let system sleep go ahead further, so
      this patch doesn't recover device under this situation.
      
      Also add comments on the case.
      Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
      Cc: Steve Glendinning <steve.glendinning@shawell.net>
      Signed-off-by: default avatarMing Lei <ming.lei@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      0d41be53
    • Ming Lei's avatar
      usbnet: qmi_wwan: comments on suspend failure · 81b50be0
      Ming Lei authored
      If suspend callback fails in system sleep context, usb core will
      ignore the failure and let system sleep go ahead further, so
      this patch comments on the case and requires that both
      usbnet_suspend() and subdriver->suspend() MUST return 0 in
      system sleep context.
      Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
      Acked-by: default avatarBjørn Mork <bjorn@mork.no>
      Signed-off-by: default avatarMing Lei <ming.lei@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      81b50be0
    • Ming Lei's avatar
      usbnet: cdc_mbim: comments on suspend failure · 9a44312a
      Ming Lei authored
      If suspend callback fails in system sleep context, usb core will
      ignore the failure and let system sleep go ahead further, so
      this patch comments on the case and requires that both
      usbnet_suspend() and subdriver->suspend() MUST return 0 in
      system sleep context.
      Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
      Acked-by: default avatarBjørn Mork <bjorn@mork.no>
      Signed-off-by: default avatarMing Lei <ming.lei@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9a44312a
    • Ming Lei's avatar
      USBHID: don't recover device if suspend fails in system sleep · 37093b70
      Ming Lei authored
      If suspend callback fails in system sleep context, usb core will
      ignore the failure and let the system sleep go ahead further, so this
      patch doesn't recover device under this situation, otherwise
      may cause resume() confused.
      Acked-by: default avatarJiri Kosina <jkosina@suse.cz>
      Signed-off-by: default avatarMing Lei <ming.lei@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      37093b70
    • Ming Lei's avatar
      USB: serial: comments on suspend failure · 93e4f47f
      Ming Lei authored
      If suspend callback fails in system sleep context, usb core will
      ignore the failure and let system sleep go ahead further, so
      this patch comments on the case and requires that serial->type->suspend()
      MUST return 0 in system sleep context.
      Acked-by: default avatarJohan Hovold <jhovold@gmail.com>
      Signed-off-by: default avatarMing Lei <ming.lei@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      93e4f47f
    • Ming Lei's avatar
      USB: adds comment on suspend callback · 303f0847
      Ming Lei authored
      This patch adds comments on interface driver suspend callback
      to emphasize that the failure return value is ignored by
      USB core in system sleep context, so do not try to recover
      device for this case and let resume/reset_resume callback
      handle the suspend failure if needed.
      
      Also kerneldoc for usb_suspend_both() is updated with the
      fact.
      Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarMing Lei <ming.lei@canonical.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      303f0847
    • Greg Kroah-Hartman's avatar
      Merge 3.9-rc4 into usb-next · 2849a3a9
      Greg Kroah-Hartman authored
      This picks up the fixes we had for USB in 3.9-rc4
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2849a3a9
  2. 23 Mar, 2013 8 commits
  3. 22 Mar, 2013 18 commits
    • Linus Torvalds's avatar
      Merge git://git.infradead.org/users/willy/linux-nvme · 5da273fe
      Linus Torvalds authored
      Pull NVMe driver update from Matthew Wilcox:
       "These patches have mostly been baking for a few months; sorry I didn't
        get them in during the merge window.  They're all bug fixes, except
        for the addition of the SMART log and the addition to MAINTAINERS."
      
      * git://git.infradead.org/users/willy/linux-nvme:
        NVMe: Add namespaces with no LBA range feature
        MAINTAINERS: Add entry for the NVMe driver
        NVMe: Initialize iod nents to 0
        NVMe: Define SMART log
        NVMe: Add result to nvme_get_features
        NVMe: Set result from user admin command
        NVMe: End queued bio requests when freeing queue
        NVMe: Free cmdid on nvme_submit_bio error
      5da273fe
    • Linus Torvalds's avatar
      Merge branch 'akpm' (fixes from Andrew) · 14629ed3
      Linus Torvalds authored
      Merge misc fixes from Andrew Morton.
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        mqueue: sys_mq_open: do not call mnt_drop_write() if read-only
        mm/hotplug: only free wait_table if it's allocated by vmalloc
        dma-debug: update DMA debug API to better handle multiple mappings of a buffer
        dma-debug: fix locking bug in check_unmap()
        drivers/rtc/rtc-at91rm9200.c: use a variable for storing IMR
        drivers/video/ep93xx-fb.c: include <linux/io.h> for devm_ioremap()
        drivers/rtc/rtc-da9052.c: fix for rtc device registration
        mm: zone_end_pfn is too small
        poweroff: change orderly_poweroff() to use schedule_work()
        mm/hugetlb: fix total hugetlbfs pages count when using memory overcommit accouting
        printk: Provide a wake_up_klogd() off-case
        irq_work.h: fix warning when CONFIG_IRQ_WORK=n
      14629ed3
    • Vladimir Davydov's avatar
      mqueue: sys_mq_open: do not call mnt_drop_write() if read-only · 38d78e58
      Vladimir Davydov authored
      mnt_drop_write() must be called only if mnt_want_write() succeeded,
      otherwise the mnt_writers counter will diverge.
      
      mnt_writers counters are used to check if remounting FS as read-only is
      OK, so after an extra mnt_drop_write() call, it would be impossible to
      remount mqueue FS as read-only.  Besides, on umount a warning would be
      printed like this one:
      
        =====================================
        [ BUG: bad unlock balance detected! ]
        3.9.0-rc3 #5 Not tainted
        -------------------------------------
        a.out/12486 is trying to release lock (sb_writers) at:
        mnt_drop_write+0x1f/0x30
        but there are no more locks to release!
      Signed-off-by: default avatarVladimir Davydov <vdavydov@parallels.com>
      Cc: Doug Ledford <dledford@redhat.com>
      Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
      Cc: "Eric W. Biederman" <ebiederm@xmission.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      38d78e58
    • Jianguo Wu's avatar
      mm/hotplug: only free wait_table if it's allocated by vmalloc · ca4b3f30
      Jianguo Wu authored
      zone->wait_table may be allocated from bootmem, it can not be freed.
      Signed-off-by: default avatarJianguo Wu <wujianguo@huawei.com>
      Reviewed-by: default avatarTang Chen <tangchen@cn.fujitsu.com>
      Cc: Tang Chen <tangchen@cn.fujitsu.com>
      Cc: Jiang Liu <jiang.liu@huawei.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ca4b3f30
    • Alexander Duyck's avatar
      dma-debug: update DMA debug API to better handle multiple mappings of a buffer · 96e7d7a1
      Alexander Duyck authored
      There were reports of the igb driver unmapping buffers without calling
      dma_mapping_error.  On closer inspection issues were found in the DMA
      debug API and how it handled multiple mappings of the same buffer.
      
      The issue I found is the fact that the debug_dma_mapping_error would
      only set the map_err_type to MAP_ERR_CHECKED in the case that the was
      only one match for device and device address.  However in the case of
      non-IOMMU, multiple addresses existed and as a result it was not setting
      this field once a second mapping was instantiated.  I have resolved this
      by changing the search so that it instead will now set MAP_ERR_CHECKED
      on the first buffer that matches the device and DMA address that is
      currently in the state MAP_ERR_NOT_CHECKED.
      
      A secondary side effect of this patch is that in the case of multiple
      buffers using the same address only the last mapping will have a valid
      map_err_type.  The previous mappings will all end up with map_err_type
      set to MAP_ERR_CHECKED because of the dma_mapping_error call in
      debug_dma_map_page.  However this behavior may be preferable as it means
      you will likely only see one real error per multi-mapped buffer, versus
      the current behavior of multiple false errors mer multi-mapped buffer.
      Signed-off-by: default avatarAlexander Duyck <alexander.h.duyck@intel.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Reviewed-by: default avatarShuah Khan <shuah.khan@hp.com>
      Tested-by: default avatarShuah Khan <shuah.khan@hp.com>
      Cc: Jakub Kicinski <kubakici@wp.pl>
      Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      96e7d7a1
    • Alexander Duyck's avatar
      dma-debug: fix locking bug in check_unmap() · 8d640a51
      Alexander Duyck authored
      In check_unmap() it is possible to get into a dead-locked state if
      dma_mapping_error is called.  The problem is that the bucket is locked in
      check_unmap, and locked again by debug_dma_mapping_error which is called
      by dma_mapping_error.  To resolve that we must release the lock on the
      bucket before making the call to dma_mapping_error.
      
      [akpm@linux-foundation.org: restore 80-col trickery to be consistent with the rest of the file]
      Signed-off-by: default avatarAlexander Duyck <alexander.h.duyck@intel.com>
      Cc: Joerg Roedel <joro@8bytes.org>
      Reviewed-by: default avatarShuah Khan <shuah.khan@hp.com>
      Tested-by: default avatarShuah Khan <shuah.khan@hp.com>
      Cc: Jakub Kicinski <kubakici@wp.pl>
      Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8d640a51
    • Nicolas Ferre's avatar
      drivers/rtc/rtc-at91rm9200.c: use a variable for storing IMR · 0ef1594c
      Nicolas Ferre authored
      On some revisions of AT91 SoCs, the RTC IMR register is not working.
      Instead of elaborating a workaround for that specific SoC or IP version,
      we simply use a software variable to store the Interrupt Mask Register
      and modify it for each enabling/disabling of an interrupt.  The overhead
      of this is negligible anyway.
      
      The interrupt mask register (IMR) for the RTC is broken on the AT91SAM9x5
      sub-family of SoCs (good overview of the members here:
      http://www.eewiki.net/display/linuxonarm/AT91SAM9x5 ).  The "user visible
      effect" is the RTC doesn't work.
      
      That sub-family is less than two years old and only has devicetree (DT)
      support and came online circa lk 3.7 .  The dust is yet to settle on the
      DT stuff at least for AT91 SoCs (translation: lots of stuff is still
      broken, so much that it is hard to know where to start).
      
      The fix in the patch is pretty simple: just shadow the silicon IMR
      register with a variable in the driver.  Some older SoCs (pre-DT) use the
      the rtc-at91rm9200 driver (e.g.  obviously the AT91RM9200) and they should
      not be impacted by the change.  There shouldn't be a large volume of
      interrupts associated with a RTC.
      Signed-off-by: default avatarNicolas Ferre <nicolas.ferre@atmel.com>
      Reported-by: default avatarDouglas Gilbert <dgilbert@interlog.com>
      Cc: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
      Cc: Ludovic Desroches <ludovic.desroches@atmel.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      0ef1594c
    • H Hartley Sweeten's avatar
      drivers/video/ep93xx-fb.c: include <linux/io.h> for devm_ioremap() · e66b0587
      H Hartley Sweeten authored
      Commit be867814 ("drivers/video/ep93xx-fb.c: use devm_ functions")
      introduced a build error:
      
        drivers/video/ep93xx-fb.c: In function 'ep93xxfb_probe':
        drivers/video/ep93xx-fb.c:532: error: implicit declaration of function 'devm_ioremap'
        drivers/video/ep93xx-fb.c:533: warning: assignment makes pointer from integer without a cast
      
      Include <linux/io.h> to pickup the declaration of 'devm_ioremap'.
      Signed-off-by: default avatarH Hartley Sweeten <hsweeten@visionengravers.com>
      Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
      Acked-by: default avatarRyan Mallon <rmallon@gmail.com>
      Cc: Damien Cassou <damien.cassou@lifl.fr>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e66b0587
    • Ashish Jangam's avatar
      drivers/rtc/rtc-da9052.c: fix for rtc device registration · 925e8ea6
      Ashish Jangam authored
      Add support for the virtual irq since now MFD only handles virtual irq
      Without this patch rtc device will fail in registration.
      
      (akpm: Ashish has a different version whcih will be needed for 3.8.x and
      earlier kernels)
      Signed-off-by: default avatarAshish <ashish.jangam@kpitcummins.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      925e8ea6
    • Russ Anderson's avatar
      mm: zone_end_pfn is too small · f9228b20
      Russ Anderson authored
      Booting with 32 TBytes memory hits BUG at mm/page_alloc.c:552! (output
      below).
      
      The key hint is "page 4294967296 outside zone".
      4294967296 = 0x100000000 (bit 32 is set).
      
      The problem is in include/linux/mmzone.h:
      
        530 static inline unsigned zone_end_pfn(const struct zone *zone)
        531 {
        532         return zone->zone_start_pfn + zone->spanned_pages;
        533 }
      
      zone_end_pfn is "unsigned" (32 bits).  Changing it to "unsigned long"
      (64 bits) fixes the problem.
      
      zone_end_pfn() was added recently in commit 108bcc96 ("mm: add & use
      zone_end_pfn() and zone_spans_pfn()")
      
      Output from the failure.
      
        No AGP bridge found
        page 4294967296 outside zone [ 4294967296 - 4327469056 ]
        ------------[ cut here ]------------
        kernel BUG at mm/page_alloc.c:552!
        invalid opcode: 0000 [#1] SMP
        Modules linked in:
        CPU 0
        Pid: 0, comm: swapper Not tainted 3.9.0-rc2.dtp+ #10
        RIP: free_one_page+0x382/0x430
        Process swapper (pid: 0, threadinfo ffffffff81942000, task ffffffff81955420)
        Call Trace:
          __free_pages_ok+0x96/0xb0
          __free_pages+0x25/0x50
          __free_pages_bootmem+0x8a/0x8c
          __free_memory_core+0xea/0x131
          free_low_memory_core_early+0x4a/0x98
          free_all_bootmem+0x45/0x47
          mem_init+0x7b/0x14c
          start_kernel+0x216/0x433
          x86_64_start_reservations+0x2a/0x2c
          x86_64_start_kernel+0x144/0x153
        Code: 89 f1 ba 01 00 00 00 31 f6 d3 e2 4c 89 ef e8 66 a4 01 00 e9 2c fe ff ff 0f 0b eb fe 0f 0b 66 66 2e 0f 1f 84 00 00 00 00 00 eb f3 <0f> 0b eb fe 0f 0b 0f 1f 84 00 00 00 00 00 eb f6 0f 0b eb fe 49
      Signed-off-by: default avatarRuss Anderson <rja@sgi.com>
      Reported-by: default avatarGeorge Beshers <gbeshers@sgi.com>
      Acked-by: default avatarHedi Berriche <hedi@sgi.com>
      Cc: Cody P Schafer <cody@linux.vnet.ibm.com>
      Cc: Michal Hocko <mhocko@suse.cz>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f9228b20
    • Oleg Nesterov's avatar
      poweroff: change orderly_poweroff() to use schedule_work() · 2ca067ef
      Oleg Nesterov authored
      David said:
      
          Commit 6c0c0d4d ("poweroff: fix bug in orderly_poweroff()")
          apparently fixes one bug in orderly_poweroff(), but introduces
          another.  The comments on orderly_poweroff() claim it can be called
          from any context - and indeed we call it from interrupt context in
          arch/powerpc/platforms/pseries/ras.c for example.  But since that
          commit this is no longer safe, since call_usermodehelper_fns() is not
          safe in interrupt context without the UMH_NO_WAIT option.
      
      orderly_poweroff() can be used from any context but UMH_WAIT_EXEC is
      sleepable.  Move the "force" logic into __orderly_poweroff() and change
      orderly_poweroff() to use the global poweroff_work which simply calls
      __orderly_poweroff().
      
      While at it, remove the unneeded "int argc" and change argv_split() to
      use GFP_KERNEL.
      
      We use the global "bool poweroff_force" to pass the argument, this can
      obviously affect the previous request if it is pending/running.  So we
      only allow the "false => true" transition assuming that the pending
      "true" should succeed anyway.  If schedule_work() fails after that we
      know that work->func() was not called yet, it must see the new value.
      
      This means that orderly_poweroff() becomes async even if we do not run
      the command and always succeeds, schedule_work() can only fail if the
      work is already pending.  We can export __orderly_poweroff() and change
      the non-atomic callers which want the old semantics.
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Reported-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      Reported-by: default avatarDavid Gibson <david@gibson.dropbear.id.au>
      Cc: Lucas De Marchi <lucas.demarchi@profusion.mobi>
      Cc: Feng Hong <hongfeng@marvell.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Serge Hallyn <serge.hallyn@canonical.com>
      Cc: "Eric W. Biederman" <ebiederm@xmission.com>
      Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2ca067ef
    • Wanpeng Li's avatar
      mm/hugetlb: fix total hugetlbfs pages count when using memory overcommit accouting · d0028588
      Wanpeng Li authored
      hugetlb_total_pages is used for overcommit calculations but the current
      implementation considers only the default hugetlb page size (which is
      either the first defined hugepage size or the one specified by
      default_hugepagesz kernel boot parameter).
      
      If the system is configured for more than one hugepage size, which is
      possible since commit a137e1cc ("hugetlbfs: per mount huge page
      sizes") then the overcommit estimation done by __vm_enough_memory()
      (resp.  shown by meminfo_proc_show) is not precise - there is an
      impression of more available/allowed memory.  This can lead to an
      unexpected ENOMEM/EFAULT resp.  SIGSEGV when memory is accounted.
      
      Testcase:
        boot: hugepagesz=1G hugepages=1
        the default overcommit ratio is 50
        before patch:
      
          egrep 'CommitLimit' /proc/meminfo
          CommitLimit:     55434168 kB
      
        after patch:
      
          egrep 'CommitLimit' /proc/meminfo
          CommitLimit:     54909880 kB
      
      [akpm@linux-foundation.org: coding-style tweak]
      Signed-off-by: default avatarWanpeng Li <liwanp@linux.vnet.ibm.com>
      Acked-by: default avatarMichal Hocko <mhocko@suse.cz>
      Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
      Cc: Hillf Danton <dhillf@gmail.com>
      Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
      Cc: <stable@vger.kernel.org>		[3.0+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d0028588
    • Frederic Weisbecker's avatar
      printk: Provide a wake_up_klogd() off-case · dc72c32e
      Frederic Weisbecker authored
      wake_up_klogd() is useless when CONFIG_PRINTK=n because neither printk()
      nor printk_sched() are in use and there are actually no waiter on
      log_wait waitqueue.  It should be a stub in this case for users like
      bust_spinlocks().
      
      Otherwise this results in this warning when CONFIG_PRINTK=n and
      CONFIG_IRQ_WORK=n:
      
      	kernel/built-in.o In function `wake_up_klogd':
      	(.text.wake_up_klogd+0xb4): undefined reference to `irq_work_queue'
      
      To fix this, provide an off-case for wake_up_klogd() when
      CONFIG_PRINTK=n.
      
      There is much more from console_unlock() and other console related code
      in printk.c that should be moved under CONFIG_PRINTK.  But for now,
      focus on a minimal fix as we passed the merged window already.
      
      [akpm@linux-foundation.org: include printk.h in bust_spinlocks.c]
      Signed-off-by: default avatarFrederic Weisbecker <fweisbec@gmail.com>
      Reported-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Cc: James Hogan <james.hogan@imgtec.com>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Ingo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      dc72c32e
    • James Hogan's avatar
      irq_work.h: fix warning when CONFIG_IRQ_WORK=n · fe8d5261
      James Hogan authored
      A randconfig caught repeated compiler warnings when CONFIG_IRQ_WORK=n
      due to the definition of a non-inline static function in
      <linux/irq_work.h>:
      
        include/linux/irq_work.h +40 : warning: 'irq_work_needs_cpu' defined but not used
      
      Make it inline to supress the warning.  This is caused commit
      00b42959 ("irq_work: Don't stop the tick with pending works") merged
      in v3.9-rc1.
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Signed-off-by: default avatarFrederic Weisbecker <fweisbec@gmail.com>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fe8d5261
    • Takahisa Tanaka's avatar
      watchdog: sp5100_tco: Set the AcpiMmioSel bitmask value to 1 instead of 2 · 81fc933f
      Takahisa Tanaka authored
      The AcpiMmioSel bit is bit 1 in the AcpiMmioEn register, but the current
      sp5100_tco driver is using bit 2.
      
      See 2.3.3 Power Management (PM) Registers page 150 of the
      AMD SB800-Series Southbridges Register Reference Guide [1].
      
              AcpiMmioEn - RW – 8/16/32 bits - [PM_Reg: 24h]
              Field Name        Bits  Default  Description
              AcpiMMioDecodeEn  0     0b       Set to 1 to enable AcpiMMio space.
              AcpiMMIoSel       1     0b       Set AcpiMMio registers to be memory-mapped or IO-mapped space.
                                               0: Memory-mapped space
                                               1: I/O-mapped space
      
      The sp5100_tco driver expects zero as a value of AcpiMmioSel (bit 1).
      
      Fortunately, no problems were caused by this typo, because the default
      value of the undocumented misused bit 2 seems to be zero.
      
      However, the sp5100_tco driver should use the correct bitmask value.
      
      [1] http://support.amd.com/us/Embedded_TechDocs/45482.pdfSigned-off-by: default avatarTakahisa Tanaka <mc74hc00@gmail.com>
      Signed-off-by: default avatarPaul Menzel <paulepanter@users.sourceforge.net>
      Signed-off-by: default avatarWim Van Sebroeck <wim@iguana.be>
      Cc: stable <stable@vger.kernel.org>
      81fc933f
    • Takahisa Tanaka's avatar
      watchdog: sp5100_tco: Remove code that may cause a boot failure · 18e43212
      Takahisa Tanaka authored
      A problem was found on PC's with the SB700 chipset: The PC fails to
      load BIOS after running the 3.8.x kernel until the power is completely
      cut off. It occurs in all 3.8.x versions and the mainline version as of
      2/4. The issue does not occur with the 3.7.x builds.
      
      There are two methods for accessing the watchdog registers.
      
       1. Re-programming a resource address obtained by allocate_resource()
      to chipset.
       2. Use the direct memory-mapped IO access.
      
      The method 1 can be used by all the chipsets (SP5100, SB7x0, SB8x0 or
      later). However, experience shows that only PC with the SB8x0 (or
      later) chipsets can use the method 2.
      
      This patch removes the method 1, because the critical problem was found.
      That's why the watchdog timer was able to be used on SP5100 and SB7x0
      chipsets until now.
      
      Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1116835
      Link: https://lkml.org/lkml/2013/2/14/271Signed-off-by: default avatarTakahisa Tanaka <mc74hc00@gmail.com>
      Signed-off-by: default avatarWim Van Sebroeck <wim@iguana.be>
      Cc: stable <stable@vger.kernel.org>
      18e43212
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/virt/kvm/kvm · b9cb3bf4
      Linus Torvalds authored
      Pull KVM fix from Marcelo Tosatti:
       "Fix compilation on PPC with !CONFIG_KVM"
      
      * git://git.kernel.org/pub/scm/virt/kvm/kvm:
        Revert "KVM: allow host header to be included even for !CONFIG_KVM"
      b9cb3bf4
    • Linus Torvalds's avatar
      Merge tag 'usb-3.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 8f46c507
      Linus Torvalds authored
      Pull USB fixes from Greg Kroah-Hartman:
       "Here are a number of USB fixes that resolve issues that have been
        reported against 3.9-rc3."
      
      * tag 'usb-3.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (37 commits)
        USB: ti_usb_3410_5052: fix use-after-free in TIOCMIWAIT
        USB: ssu100: fix use-after-free in TIOCMIWAIT
        USB: spcp8x5: fix use-after-free in TIOCMIWAIT
        USB: quatech2: fix use-after-free in TIOCMIWAIT
        USB: pl2303: fix use-after-free in TIOCMIWAIT
        USB: oti6858: fix use-after-free in TIOCMIWAIT
        USB: mos7840: fix use-after-free in TIOCMIWAIT
        USB: mos7840: fix broken TIOCMIWAIT
        USB: mct_u232: fix use-after-free in TIOCMIWAIT
        USB: io_ti: fix use-after-free in TIOCMIWAIT
        USB: io_edgeport: fix use-after-free in TIOCMIWAIT
        USB: ftdi_sio: fix use-after-free in TIOCMIWAIT
        USB: f81232: fix use-after-free in TIOCMIWAIT
        USB: cypress_m8: fix use-after-free in TIOCMIWAIT
        USB: ch341: fix use-after-free in TIOCMIWAIT
        USB: ark3116: fix use-after-free in TIOCMIWAIT
        USB: serial: add modem-status-change wait queue
        USB: serial: fix interface refcounting
        USB: io_ti: fix get_icount for two port adapters
        USB: garmin_gps: fix memory leak on disconnect
        ...
      8f46c507