Pull from Jiri Kosina:
 "Please pull to receive updates for HID layer.  Nikolai's patch is
  rather important and should still go in for 3.3, as it's a regression
  fix for commit b4b583d4."

* 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: hid-input: allow array fields out of range
  HID: usbhid: Add NOGET quirk for the AIREN Slim+ keyboard

Allow array field values out of range as per HID 1.11 specification,
section 6.2.25:

	Rather than returning a single bit for each button in the group, an
	array returns an index in each field that corresponds to the pressed
	button (like keyboard scan codes). An out-of range value in and array
	field is considered no controls asserted.

Apparently, "and" above is a typo and should be "an".

This fixes at least Waltop tablet pen clicks - otherwise BTN_TOUCH is never
released.

The relevant part of Waltop tablet report descriptors is this:

	0x09, 0x42,         /*          Usage (Tip Switch),         */
	0x09, 0x44,         /*          Usage (Barrel Switch),      */
	0x09, 0x46,         /*          Usage (Tablet Pick),        */
	0x15, 0x01,         /*          Logical Minimum (1),        */
	0x25, 0x03,         /*          Logical Maximum (3),        */
	0x75, 0x04,         /*          Report Size (4),            */
	0x95, 0x01,         /*          Report Count (1),           */
	0x80,               /*          Input,                      */

This is a regression fix for commit b4b583d4 ("HID: be more strict when
ignoring out-of-range fields").
Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

MFD fixes from Samuel Ortiz:
 "This is the pull request for the MFD fixes for 3.3.  We have a few
  NULL pointer dereferences fixes, an ACPI conflict check fix, and a
  couple of wm8994 fixes."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6:
  mfd: Correct readability of WM8994 DC servo 4E register
  mfd: Initialize tps65912 irq platform data properly
  mfd: Fix ACPI conflict check
  mfd: Fix ab8500 error path bug
  mfd: Test for jack detection when deciding if wm8994 should suspend
  mfd: Initialize tps65910 irq platform data properly
  mfd: Fix possible s5m null pointer dereference
  mfd: wm8350 variable dereferenced before check

It's only used inside fs/dcache.c, and we're going to play games with it
for the word-at-a-time patches.  This time we really don't even want to
export it, because it really is an internal function to fs/dcache.c, and
has been since it was introduced.

Having it in that extremely hot header file (it's included in pretty
much everything, thanks to <linux/fs.h>) is a disaster for testing
different versions, and is utterly pointless.

We really should have some kind of header file diet thing, where we
figure out which parts of header files are really better off private and
only result in more expensive compiles.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

SCSI fixes from James Bottomley:
 "There's just a single fix in here: the osd max device number fix."

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
  [SCSI] osd_uld: Bump MAX_OSD_DEVICES from 64 to 1,048,576

PARISC fixes from James Bottomley:
 "This is a set of build fixes to get the cross compiled architecture
  testbeds building again"

* tag 'parisc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/parisc-2.6:
  [PARISC] don't unconditionally override CROSS_COMPILE for 64 bit.
  [PARISC] include <linux/prefetch.h> in drivers/parisc/iommu-helpers.h
  [PARISC] fix compile break caused by iomap: make IOPORT/PCI mapping functions conditional

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/x86/kvm: Fix Host-Only/Guest-Only counting with SVM disabled

Pull from Herbert Xu:
  "This push fixes a bug in mv_cesa that causes all hash operations
   that supply data on a final operation to fail."

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: mv_cesa - fix final callback not ignoring input data

Commit 5707c87f "vfs: uninline full_name_hash()" broke the modular
build, because it needs exporting now that it isn't inlined any more.
Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

hhwmon fixes for 3.3-rc6 from Guenter Roeck:

These patches are necessary for correct operation and management of
F75387.

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (f75375s) Catch some attempts to write to r/o registers
  hwmon: (f75375s) Properly map the F75387 automatic modes to pwm_enable
  hwmon: (f75375s) Make pwm*_mode writable for the F75387
  hwmon: (f75375s) Fix writes to the pwm* attribute for the F75387

fbdev fixes for 3.3 from Florian Tobias Schandinat

It includes:
 - two fixes for OMAP HDMI
 - one fix to make new OMAP functions behave as they are supposed to
 - one Kconfig dependency fix
 - two fixes for viafb for modesetting on VX900 hardware

* tag 'fbdev-fixes-for-3.3-2' of git://github.com/schandinat/linux-2.6:
  OMAPDSS: APPLY: make ovl_enable/disable synchronous
  OMAPDSS: panel-dvi: Add Kconfig dependency on I2C
  viafb: fix IGA1 modesetting on VX900
  viafb: select HW scaling on VX900 for IGA2
  OMAPDSS: HDMI: hot plug detect fix
  OMAPDSS: HACK: Ensure DSS clock domain gets out of idle when HDMI is enabled

sound fixes for 3.3-rc6 from Takashi Iwai

This contains again regression fixes for various HD-audio and ASoC
regarding SSI and dapm shutdown path.  In addition, a minor azt3328
fix and the correction of the new jack-notification strings in HD-audio.

* tag 'sound-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda - Kill hyphenated names
  ALSA: hda - Add a fake mute feature
  ALSA: hda - Always set HP pin in unsol handler for STAC/IDT codecs
  ALSA: azt3328 - Fix NULL ptr dereference on cards without OPL3
  ALSA: hda/realtek - Fix resume of multiple input sources
  ASoC: i.MX SSI: Fix DSP_A format.
  ASoC: dapm: Check for bias level when powering down

The code in link_path_walk() that finds out the length and the hash of
the next path component is some of the hottest code in the kernel.  And
I have a version of it that does things at the full width of the CPU
wordsize at a time, but that means that we *really* want to split it up
into a separate helper function.

So this re-organizes the code a bit and splits the hashing part into a
helper function called "hash_name()".  It returns the length of the
pathname component, while at the same time computing and writing the
hash to the appropriate location.

The code generation is slightly changed by this patch, but generally for
the better - and the added abstraction actually makes the code easier to
read too.  And the new interface is well suited for replacing just the
"hash_name()" function with alternative implementations.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

It did some odd things for unclear reasons.  As this is one of the
functions that gets changed when doing word-at-a-time compares, this is
yet another of the "don't change any semantics, but clean things up so
that subsequent patches don't get obscured by the cleanups".
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

.. and also use it in lookup_one_len() rather than open-coding it.

There aren't any performance-critical users, so inlining it is silly.
But it wouldn't matter if it wasn't for the fact that the word-at-a-time
dentry name patches want to conditionally replace the function, and
uninlining it sets the stage for that.

So again, this is a preparatory patch that doesn't change any semantics,
and only prepares for a much cleaner and testable word-at-a-time dentry
name accessor patch.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

These don't change any semantics, but they clean up the code a bit and
mark some arguments appropriately 'const'.

They came up as I was doing the word-at-a-time dcache name accessor
code, and cleaning this up now allows me to send out a smaller relevant
interesting patch for the experimental stuff.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

It makes no sense to attempt to manually configure the fan in auto mode,
or set the duty cycle directly in closed loop mode.  The corresponding
registers are then read-only.  If the user tries it nonetheless, error out
with EINVAL instead of silently doing nothing.
Signed-off-by: Nikolaus Schulz <mail@microschulz.de>
[guenter.roeck@ericsson.com: Minor formatting cleanup]
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>

The F75387 supports automatic fan control using either PWM duty cycle or
RPM speed values.  Make the driver detect the latter mode, and expose the
different modes in sysfs as per pwm_enable, so that the user can switch
between them.

The interpretation of the pwm_enable attribute for the F75387 is adjusted
to be a superset of those values used for similar Fintek chips which do
not support automatic duty mode, with 2 mapping to automatic speed mode,
and moving automatic duty mode to the new value 4.

Toggling the duty mode via pwm_enable is currently denied for the F75387,
as the chip then simply reinterprets the fan configuration register values
according to the new mode, switching between RPM and PWM units, which
makes this a dangerous operation.

This patch introduces a new pwm mode into the driver. This is necessary
because the new mode (automatic pwm mode, 4) may already be enabled by the
BIOS, and the driver should not break existing functionality. This was seen
on at least one board.
Signed-off-by: Nikolaus Schulz <mail@microschulz.de>
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>

Merge branches 'core-urgent-for-linus', 'perf-urgent-for-linus' and 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pulling latest branches from Ingo:

* 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  memblock: Fix size aligning of memblock_alloc_base_nid()

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf probe: Ensure offset provided is not greater than function length without DWARF info too
  perf tools: Ensure comm string is properly terminated
  perf probe: Ensure offset provided is not greater than function length
  perf evlist: Return first evsel for non-sample event on old kernel
  perf/hwbp: Fix a possible memory leak

* 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  CPU hotplug, cpusets, suspend: Don't touch cpusets during suspend/resume

There is only one error code to return for a bad user-space buffer
pointer passed to a system call in the same address space as the
system call is executed, and that is EFAULT.  Furthermore, the
low-level access routines, which catch most of the faults, return
EFAULT already.
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Roland McGrath <roland@hack.frob.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The regset common infrastructure assumed that regsets would always
have .get and .set methods, but not necessarily .active methods.
Unfortunately people have since written regsets without .set methods.

Rather than putting in stub functions everywhere, handle regsets with
null .get or .set methods explicitly.
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Roland McGrath <roland@hack.frob.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

It turned out that a performance counter on AMD does not
count at all when the GO or HO bit is set in the control
register and SVM is disabled in EFER.

This patch works around this issue by masking out the HO bit
in the performance counter control register when SVM is not
enabled.

The GO bit is not touched because it is only set when the
user wants to count in guest-mode only. So when SVM is
disabled the counter should not run at all and the
not-counting is the intended behaviour.
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Avi Kivity <avi@redhat.com>
Cc: Stephane Eranian <eranian@google.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Gleb Natapov <gleb@redhat.com>
Cc: Robert Richter <robert.richter@amd.com>
Cc: stable@vger.kernel.org # v3.2
Link: http://lkml.kernel.org/r/1330523852-19566-1-git-send-email-joerg.roedel@amd.comSigned-off-by: Ingo Molnar <mingo@elte.hu>

Kill hyphens from "Line-Out" name strings, as suggested by Mark Brown.
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Merge tag 'perf-urgent-for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent

Various smaller perf/urgent fixes.
Signed-off-by: Ingo Molnar <mingo@elte.hu>

Watchdog updates from Wim Van Sebroeck:

* git://www.linux-watchdog.org/linux-watchdog:
  watchdog: fix GETTIMEOUT ioctl in booke_wdt
  watchdog: update maintainers git entry
  watchdog: Fix typo in pnx4008_wdt.c
  watchdog: Fix typo in Kconfig
  watchdog: fix error in probe() of s3c2410_wdt (reset at booting)
  watchdog: hpwdt: clean up set_memory_x call for 32 bit

Pull from Mark Brown:
 "A simple, driver specific fix.  This device isn't widely used outside
  of Marvell reference boards most of which are probably used with their
  BSPs rather than with mainline so low risk."

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: fix the ldo configure according to 88pm860x spec

i2c bugfix from Wolfram Sang:
  "This patch fixes a wrong assumption in the mxs-i2c-driver about a
   command queue being done.  Without it, we have seen races when the
   bus was under load."

* 'i2c-embedded/for-3.3' of git://git.pengutronix.de/git/wsa/linux-2.6:
  i2c: mxs: only flag completion when queue is completely done

DRM fixes from Dave Airlie:
  intel: fixes for output regression on 965GM, an oops and a machine
  hang

  radeon: uninitialised var (that gcc didn't warn about for some reason)
  + a couple of correctness fixes.

  exynos: fixes for various things, drop some chunks of unused code.

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon/kms/vm: fix possible bug in radeon_vm_bo_rmv()
  drm/radeon: fix uninitialized variable
  drm/radeon/kms: fix radeon_dp_get_modes for LVDS bridges (v2)
  drm/i915: Remove use of the autoreported ringbuffer HEAD position
  drm/i915: Prevent a machine hang by checking crtc->active before loading lut
  drm/i915: fix operator precedence when enabling RC6p
  drm/i915: fix a sprite watermark computation to avoid divide by zero if xpos<0
  drm/i915: fix mode set on load pipe. (v2)
  drm/exynos: exynos_drm.h header file fixes
  drm/exynos: added panel physical size.
  drm/exynos: added postclose to release resource.
  drm/exynos: removed exynos_drm_fbdev_recreate function.
  drm/exynos: fixed page flip issue.
  drm/exynos: added possible_clones setup function.
  drm/exynos: removed pageflip_event_list init code when closed.
  drm/exynos: changed priority of mixer layers.
  drm/exynos: Fix typo in exynos_mixer.c

Pull s390 fixes from Martin Schwidefsky

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  [S390] memory hotplug: prevent memory zone interleave
  [S390] crash_dump: remove duplicate include
  [S390] KEYS: Enable the compat keyctl wrapper on s390x

A small fix for the SSI driver and a fix for system shutdown with modern
devices.  Most of the modern devices will never get shut down normally
with a visible kernel log as the systems they're in tend not to shut
down often and when they do it's usually in form factors that don't have
a user visible console.

memblock allocator aligns @size to @align to reduce the amount
of fragmentation.  Commit:

 7bd0b0f0 ("memblock: Reimplement memblock allocation using reverse free area iterator")

Broke it by incorrectly relocating @size aligning to
memblock_find_in_range_node().  As the aligned size is not
propagated back to memblock_alloc_base_nid(), the actually
reserved size isn't aligned.

While this increases memory use for memblock reserved array,
this shouldn't cause any critical failure; however, it seems
that the size aligning was hiding a use-beyond-allocation bug in
sparc64 and losing the aligning causes boot failure.

The underlying problem is currently being debugged but this is a
proper fix in itself, it's already pretty late in -rc cycle for
boot failures and reverting the change for debugging isn't
difficult. Restore the size aligning moving it to
memblock_alloc_base_nid().
Reported-by: Meelis Roos <mroos@linux.ee>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: David S. Miller <davem@davemloft.net>
Cc: Grant Likely <grant.likely@secretlab.ca>
Cc: Rob Herring <rob.herring@calxeda.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Link: http://lkml.kernel.org/r/20120228205621.GC3252@dhcp-172-17-108-109.mtv.corp.google.comSigned-off-by: Ingo Molnar <mingo@elte.hu>
LKML-Reference: <alpine.SOC.1.00.1202130942030.1488@math.ut.ee>

It should be marked as readable but wasn't, breaking DC servo operation.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

Merge virtio pull request from Rusty Russell.

* tag 'for-linus' of git://github.com/rustyrussell/linux:
  virtio: balloon: leak / fill balloon across S4

commit e562966d added support for S4 to
the balloon driver.  The freeze function did nothing to free the pages,
since reclaiming the pages from the host to immediately give them back
(if S4 was successful) seemed wasteful.  Also, if S4 wasn't successful,
the guest would have to re-fill the balloon.  On restore, the pages were
supposed to be marked freed and the free page counters were incremented
to reflect the balloon was totally deflated.

However, this wasn't done right.  The pages that were earlier taken away
from the guest during a balloon inflation operation were just shown as
used pages after a successful restore from S4.  Just a fancy way of
leaking lots of memory.

Instead of trying that, just leak the balloon on freeze and fill it on
restore/thaw paths.  This works properly now.  The optimisation to not
leak can be added later on after a bit of refactoring of the code.
Signed-off-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

ovl->enable/disable are meant to be synchronous so that they can handle
the configuration of fifo sizes. The current kernel doesn't configure
fifo sizes yet, and so the code doesn't need to block to function (from
omapdss driver's perspective).

However, for the users of omapdss a non-blocking ovl->disable is
confusing, because they don't know when the memory area is not used
any more.

Furthermore, when the fifo size configuration is added in the next merge
window, the change from non-blocking to blocking could cause side
effects to the users of omapdss. So by making the functions block
already will keep them behaving in the same manner.

And, while not the main purpose of this patch, this will also remove the
compile warning:

drivers/video/omap2/dss/apply.c:350: warning:
'wait_pending_extra_info_updates' defined but not used
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>

panel-dvi uses i2c, but the Kconfig didn't have dependency on I2C. Add
it.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>

The 'perf probe' command allows kprobe to be inserted at any offset from
a function start, which results in adding kprobes to unintended
location.  (example: perf probe do_fork+10000 is allowed even though
size of do_fork is ~904).

My previous patch https://lkml.org/lkml/2012/2/24/42 addressed the case
where DWARF info was available for the kernel. This patch fixes the
case where perf probe is used on a kernel without debuginfo available.
Acked-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
Cc: Jason Baron <jbaron@redhat.com>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Link: http://lkml.kernel.org/r/4F4C544D.1010909@linux.vnet.ibm.comSigned-off-by: Prashanth Nageshappa <prashanth@linux.vnet.ibm.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

If threads in a multi-threaded process have names shorter than the main
thread the comm for the named threads is not properly terminated.

E.g., for the process 'namedthreads' where each thread is named noploop%d
where %d is the thread number:

Before:
    perf script -f comm,tid,ip,sym,dso
    noploop:4ads 21616  400a49 noploop (/tmp/namedthreads)
The 'ads' in the thread comm bleeds over from the process name.

After:
    perf script -f comm,tid,ip,sym,dso
       noploop:4 21616  400a49 noploop (/tmp/namedthreads)

Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1330111898-68071-1-git-send-email-dsahern@gmail.comSigned-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

The perf probe command allows kprobe to be inserted at any offset from a
function start, which results in adding kprobes to unintended location.

Example: perf probe do_fork+10000 is allowed even though size of do_fork
is ~904.

This patch will ensure probe addition fails when the offset specified is
greater than size of the function.
Acked-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
Cc: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Jason Baron <jbaron@redhat.com>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Link: http://lkml.kernel.org/r/4F473F33.4060409@linux.vnet.ibm.comSigned-off-by: Prashanth Nageshappa <prashanth@linux.vnet.ibm.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>