Pull 3 tiny tty bugfixes from Greg Kroah-Hartman.

* tag 'tty-3.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  drivers/tty/amiserial.c: add missing tty_unlock
  pch_uart: Fix dma channel unallocated issue
  ARM: clps711x: serial driver hungs are a result of call disable_irq within ISR

Pull USB fixes from Greg Kroah-Hartman:
 "Here are a number of tiny USB fixes for 3.4-rc4.

  Most of them are in the USB gadget area, but a few other minor USB
  driver and core fixes are here as well.

  Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"

* tag 'usb-3.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (36 commits)
  USB: serial: cp210x: Fixed usb_control_msg timeout values
  USB: ehci-tegra: don't call set_irq_flags(IRQF_VALID)
  USB: yurex: Fix missing URB_NO_TRANSFER_DMA_MAP flag in urb
  USB: yurex: Remove allocation of coherent buffer for setup-packet buffer
  drivers/usb/misc/usbtest.c: add kfrees
  USB: ehci-fsl: Fix kernel crash on mpc5121e
  uwb: fix error handling
  uwb: fix use of del_timer_sync() in interrupt
  EHCI: always clear the STS_FLR status bit
  EHCI: fix criterion for resuming the root hub
  USB: sierra: avoid QMI/wwan interface on MC77xx
  usb: usbtest: avoid integer overflow in alloc_sglist()
  usb: usbtest: avoid integer overflow in test_ctrl_queue()
  USB: fix deadlock in bConfigurationValue attribute method
  usb: gadget: eliminate NULL pointer dereference (bugfix)
  usb: gadget: uvc: Remove non-required locking from 'uvc_queue_next_buffer' routine
  usb: gadget: rndis: fix Missing req->context assignment
  usb: musb: omap: fix the error check for pm_runtime_get_sync
  usb: gadget: udc-core: fix asymmetric calls in remove_driver
  usb: musb: omap: fix crash when musb glue (omap) gets initialized
  ...

Merge tag 'stable/for-linus-3.4-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

Pull xen fixes from Konrad Rzeszutek Wilk:
 - mechanism to work with misconfigured backends (where they are
   advertised but in reality don't exist).
 - two tiny compile warning fixes.
 - proper error handling in gnttab_resume
 - Not using VM_PFNMAP anymore to allow backends in the same domain.

* tag 'stable/for-linus-3.4-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  Revert "xen/p2m: m2p_find_override: use list_for_each_entry_safe"
  xen/resume: Fix compile warnings.
  xen/xenbus: Add quirk to deal with misconfigured backends.
  xen/blkback: Fix warning error.
  xen/p2m: m2p_find_override: use list_for_each_entry_safe
  xen/gntdev: do not set VM_PFNMAP
  xen/grant-table: add error-handling code on failure of gnttab_resume

This reverts commit cf450136.

It breaks reboot on at least one Thinkpad T43, as reported by Jörg Otte:
 "On reboot it shuts down as normal.
  The last lines displayed are:

  >Unmounting temporary filesystems.. [OK]
  >Deactivating swap...               [OK]
  >Unmounting local filesystems...    [OK]
  >Will now restart
  >    Restarting system

  Then I hear it accessing the cd-drive, but then it's being stuck."

Jörg bisected the regression to this commit.

That commit fixes another machine (see

  https://bugzilla.kernel.org/show_bug.cgi?id=11533

for details) that has a BIOS bug and doesn't support ACPI reset.
However, at least one of those other reporters no longer even has the
machine in question, and had a different workaround to begin with.
Besides, it clearly was a buggy BIOS.  Let's not break the correct case
to fix that case.
Reported-and-bisected-by: Jörg Otte <jrg.otte@googlemail.com>
Cc: linux-acpi@vger.kernel.org
Cc: Len Brown <lenb@kernel.org>
Cc: Peter Anvin <hpa@zytor.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Commit 24aa0788 ("memblock, x86: Replace memblock_x86_reserve/
free_range() with generic ones") replaced x86 specific memblock
operations with the generic ones; unfortunately, it lost zero length
operation handling in the process making the kernel panic if somebody
tries to reserve zero length area.

There isn't much to be gained by being cranky to zero length operations
and panicking is almost the worst response.  Drop the BUG_ON() in
memblock_reserve() and update memblock_add_region/isolate_range() so
that all zero length operations are handled as noops.
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
Reported-by: Valere Monseur <valere.monseur@ymail.com>
Bisected-by: Joseph Freeman <jfree143dev@gmail.com>
Tested-by: Joseph Freeman <jfree143dev@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=43098Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pyll hwmon fixes from Guenter Roeck:
 "Two patches: Fix build warning in ads1015 driver, and fix bogus power
  values with current BIOSes in fam15h_power driver."

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (ads1015) Fix build warning
  hwmon: fam15h_power: fix bogus values with current BIOSes

Pull crypto fixes from Herbert Xu:
 - Locking fix for talitos driver
 - Fix 64-bit counter overflow in SHA-512
 - Build fix for ixp4xx.

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: talitos - properly lock access to global talitos registers
  crypto: ixp4xx - include fix
  crypto: sha512 - Fix byte counter overflow in SHA-512

Pull sound fixes from Takashi Iwai:
 "Fixes for a few regressions of HD-audio, originated partly from 3.4
  and partly 3.3.

  The fixes for ThinkPad docking-station are for 3.3 kernels, thus they
  are based on 3.3 then merged back to 3.4, so that they can be merged
  to stable tree cleanly.  The non-trivial merge conflicts are because
  of this action.

  In addition, a couple of trivial fixes for documentation and a long-
  standing issue in the listing of built-in sound driver at boot time."

* tag 'sound-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda/conexant - Set up the missing docking-station pins
  ALSA: hda/conexant - Don't set HP pin-control bit unconditionally
  ALSA: workaround: change the timing of alsa_sound_last_init()
  ALSA: hda/sigmatel - Fix inverted mute LED
  ALSA: hda/realtek - Fix regression on Quanta/Gericom KN1
  ALSA: fix core/vmaster.c kernel-doc warning

Pull HID fixes from Jiri Kosina:
 "Fix for one particular device (bluetooth Tivo Slide) and change of
  'default y' -> 'default n' for CONFIG_HID_BATTERY_STRENGTH which I
  overlooked in the initial merge of the battery support"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: default HID_BATTERY_STRENGTH to no
  HID: tivo: fix support for bluetooth version of tivo Slide

Pull m68k arch fixes from Greg Ungerer:
 "This contains four fixes for 3.4.  Two fix and clean up compilation
  for the nommu 68x328 CPU targets.  The other two fix the platform
  definition and multi-function pin setup of the second eth interface
  on the ColdFire 5275 SoC."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
  m68knommu: make sure 2nd FEC eth interface pins are enabled on 5275 ColdFire
  m68knommu: fix id number for second eth device on 5275 ColdFire
  m68knommu: move and fix the 68VZ328 platform bootlogo.h
  m68knommu: remove the unused bootlogo.h processing for 68EZ328 and 68VZ328

This reverts commit b960d6c4.

If we have another thread (very likely) touched the list, we
end up hitting a problem "that the next element is wrong because
we should be able to cope with that. The problem is that the
next->next pointer would be set LIST_POISON1. " (Stefano's
comment on the patch).

Reverting for now.
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Fixed too small hardcoded timeout values for usb_control_msg
in driver for SiliconLabs cp210x-based usb-to-serial adapters.
Replaced with USB_CTRL_GET_TIMEOUT/USB_CTRL_SET_TIMEOUT.
Signed-off-by: Yuri Matylitski <ym@tekinsoft.com>
Acked-by: Kirill A. Shutemov <kirill@shutemov.name>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

tty_unlock is used on all other exits from the function.
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Acked-by: Jiri Slaby <jslaby@suse.cz>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Pull nfsd bugfixes from J. Bruce Fields:
 "One bugfix, and one minor header fix from Jeff Layton while we're
  here"

* 'for-3.4' of git://linux-nfs.org/~bfields/linux:
  nfsd: include cld.h in the headers_install target
  nfsd: don't fail unchecked creates of non-special files

linux/drivers/xen/manage.c: In function 'do_suspend':
linux/drivers/xen/manage.c:160:5: warning: 'si.cancelled' may be used uninitialized in this function
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Pull drm fixes from Dave Airlie:
 "It's like a grab bag of one liners:

  - core: fix page flip error path, reorder object teardown.
  - usb: fix the drm_usb module license.
  - i915: VT switch on SNB with non-native modes fix, and a regression
    fix from 3.3.
  - radeon: missing unreserve on SI, AGP/VRAM setup fix (fixes radeon on
    IA64, but its a generic bug), an rn50 regression from 3.3, turn off
    MSIs on rv515 (it loses rearms every so often)."

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  nouveau: Set special lane map for the right chipset
  drm/radeon: fix load detect on rn50 with hardcoded EDIDs.
  drm: Releasing FBs before releasing GEM objects during drm_release
  drm/nouveau/pm: don't read/write beyond end of stack buffer
  drivers: gpu: drm: gma500: mdfld_dsi_output.h: Remove not unneeded include of version.h
  radeon: fix r600/agp when vram is after AGP (v3)
  drm: fix page_flip error handling
  drm/radeon/kms: fix the regression of DVI connector check
  drm/usb: fix module license on drm/usb layer.
  drm/i915: Do not set "Enable Panel Fitter" on SNB pageflips
  drm/i915: Hold mode_config lock whilst changing mode for lastclose()
  drm/radeon/si: add missing radeon_bo_unreserve in si_rlc_init() v2
  drm/radeon: disable MSI on RV515
  drm/i915: don't clobber the special upscaling lvds timings

Pull KVM updates from Marcelo Tosatti.

* git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: lock slots_lock around device assignment
  KVM: VMX: Fix kvm_set_shared_msr() called in preemptible context
  KVM: unmap pages from the iommu when slots are removed
  KVM: PMU emulation: GLOBAL_CTRL MSR should be enabled on reset

A rather annoying and common case is when booting a PVonHVM guest
and exposing the PV KBD and PV VFB - as broken toolstacks don't
always initialize the backends correctly.

Normally The HVM guest is using the VGA driver and the emulated
keyboard for this (though upstream version of QEMU implements
PV KBD, but still uses a VGA driver). We provide a very basic
two-stage wait mechanism - where we wait for 30 seconds for all
devices, and then for 270 for all them except the two mentioned.

That allows us to wait for the essential devices, like network
or disk for the full 6 minutes.

To trigger this, put this in your guest config:

vfb = [ 'vnc=1, vnclisten=0.0.0.0 ,vncunused=1']

instead of this:
vnc=1
vnclisten="0.0.0.0"

CC: stable@kernel.org
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
[v3: Split delay in non-essential (30 seconds) and essential
 devices per Ian and Stefano suggestion]
[v4: Added comments per Stefano suggestion]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

The refactoring of the nv50 logic, introduced in 8663bc7c, modified the
test for the special lane map used on some Apple computers with Nvidia
chipsets. The tested MBA3,1 would still boot, but resume from suspend
stopped working. This patch restores the old test, which fixes the problem.
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Acked-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Merge fixes for Thinkpad docking-station regressions for 3.3 kernels
back to 3.4.  These were committed in that branch to make the stable
merging easier.

Conflicts:
	sound/pci/hda/patch_conexant.c

ThinkPad 410,420,510,520 and X201 with cx50585 & co chips have the
docking-station ports, but BIOS doesn't initialize for these pins.
Thus, like the former X200, we need to set up the pins manually in the
driver.

The odd part is that the same PCI SSID is used for X200 and T400, thus
we need to prepare individual fixup tables for cx5051 and others.

Bugzilla entries:
	https://bugzilla.redhat.com/show_bug.cgi?id=808559
	https://bugzilla.redhat.com/show_bug.cgi?id=806217
	https://bugzilla.redhat.com/show_bug.cgi?id=810697Reported-by: Josh Boyer <jwboyer@redhat.com>
Reported-by: Jens Taprogge <jens.taprogge@taprogge.org>
Tested-by: Jens Taprogge <jens.taprogge@taprogge.org>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

When the force changes went in back in 3.3.0, we ended up returning
disconnected in the !force case, and the connected in when forced,
as it hit the hardcoded check.

Fix it so all exits go via the hardcoded check and stop spurious
modesets on platforms with hardcoded EDIDs.

Reported-by: Evan McNabb (Red Hat)
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>

During DRM release, all the FBs and gem objects are released. If
a gem object is being used as a FB and set to a crtc, it must not
be freed before releasing the framebuffer first.

If FBs are released first, the crtc using the FB is disabled first
so now the GEM object can be freed safely. The CRTC will be enabled
again when the driver restores fbdev mode.
Signed-off-by: Prathyush K <prathyush.k@samsung.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

NUL-terminate after strncpy.

If the parameter "profile" has length 16 or more, then strncpy
leaves "string" with no NUL terminator, so the following search
for '\n' may read beyond the end of that 16-byte buffer.
If it finds a newline there, then it will also write beyond the
end of that stack buffer.
Signed-off-by: Jim Meyering <meyering@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

The output of "make versioncheck" points a incorrect include of
version.h in the drivers/gpu/drm/gma500/mdfld_dsi_output.h:

drivers/gpu/drm/gma500/mdfld_dsi_output.h: 32 linux/version.h not needed.

If we take a look in the file, we can agree to remove it.

Cc: David Airlie <airlied@linux.ie>
Cc: <dri-devel@lists.freedesktop.org>
Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

If AGP is placed in the middle, the size_af is off-by-one, it results
in VRAM being placed at 0x7fffffff instead of 0x8000000.

v2: fix the vram_start setup.
v3: also fix r7xx & newer ASIC

Reported-by: russiane39 on #radeon
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Free event and restore event_space only when page_flip->flags has
DRM_MODE_PAGE_FLIP_EVENT if page_flip() is failed.
Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Some output pins on Conexant chips have no HP control bit, but the
auto-parser initializes these pins unconditionally with PIN_HP.

Check the pin-capability and avoid the HP bit if not supported.

Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

* 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel:
  drm/i915: Do not set "Enable Panel Fitter" on SNB pageflips
  drm/i915: Hold mode_config lock whilst changing mode for lastclose()
  drm/i915: don't clobber the special upscaling lvds timings

The check of the encoder type in the commit [e00e8b5e: drm/radeon/kms:
fix analog load detection on DVI-I connectors] is obviously wrong, and
it's the culprit of the regression on my workstation with DVI-analog
connection resulting in the blank output.

Fixed the typo now.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Commit 4f5ca836 "HID: hid-input: add support for HID devices reporting
Battery Strength" added the CONFIG_HID_BATTERY_STRENGTH option to report
the battery strength of HID devices.  The commit log explicitly mentions
it not working properly with recent userspace, but it is default y
anyway.  This is rather odd, and actually causes problems on real
systems.

This works around Fedora bug
https://bugzilla.redhat.com/show_bug.cgi?id=806295Signed-off-by: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Current alsa_sound_last_init() was called as __initcall().
So, on current ALSA, only devices that had been properly
registered at this point were shown.
So, it will show "No soundcards found" if driver requests
probe deferment. it's often misleading.
This patch delays the timing of alsa_sound_last_init()
as workaround.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Reviwed-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

While refactoring the mute-LED handling for HP laptops, I messed up
the polarity check in a wrong way.  The red (or the mute-LED if any)
should appear in the muted state, corresponding to GPIO on.
Reported-by: Mikko Vinni <mmvinni@yahoo.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Allows this module to load correctly with certain debugging options on.

Reported on irc by scientes
Signed-off-by: Dave Airlie <airlied@redhat.com>

My 9ce70c02 "memcg: fix deadlock by inverting lrucare nesting" put a
nasty little bug into v3.3's version of mem_cgroup_replace_page_cache(),
sometimes used for FUSE.  Replacing __mem_cgroup_commit_charge_lrucare()
by __mem_cgroup_commit_charge(), I used the "pc" pointer set up earlier:
but it's for oldpage, and needs now to be for newpage.  Once oldpage was
freed, its PageCgroupUsed bit (cleared above but set again here) caused
"Bad page state" messages - and perhaps worse, being missed from newpage.
(I didn't find this by using FUSE, but in reusing the function for tmpfs.)
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: stable@vger.kernel.org [v3.3 only]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Through the transition to the auto-parser, the support for
Quanta/Gericom KN1 got broken.  There are two problems behind it:

- This machine doesn't like the default COEF setup for ALC260 we take
  now as default

- BIOS doesn't set the pins correctly at all; especially the machine
  uses only the pin 0x0f for both headphone and speaker

This patch adds the fixup as a workaround for these issues.
Reported-and-tested-by: Uros Vampl <mobile.leecher@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  security: fix compile error in commoncap.c

As pointed out by Jason Baron, when assigning a device to a guest
we first set the iommu domain pointer, which enables mapping
and unmapping of memory slots to the iommu.  This leaves a window
where this path is enabled, but we haven't synchronized the iommu
mappings to the existing memory slots.  Thus a slot being removed
at that point could send us down unexpected code paths removing
non-existent pinnings and iommu mappings.  Take the slots_lock
around creating the iommu domain and initial mappings as well as
around iommu teardown to avoid this race.
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

Add missing "personality.h"
security/commoncap.c: In function 'cap_bprm_set_creds':
security/commoncap.c:510: error: 'PER_CLEAR_ON_SETID' undeclared (first use in this function)
security/commoncap.c:510: error: (Each undeclared identifier is reported only once
security/commoncap.c:510: error: for each function it appears in.)
Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>

kvm_set_shared_msr() may not be called in preemptible context,
but vmx_set_msr() does so:

  BUG: using smp_processor_id() in preemptible [00000000] code: qemu-kvm/22713
  caller is kvm_set_shared_msr+0x32/0xa0 [kvm]
  Pid: 22713, comm: qemu-kvm Not tainted 3.4.0-rc3+ #39
  Call Trace:
   [<ffffffff8131fa82>] debug_smp_processor_id+0xe2/0x100
   [<ffffffffa0328ae2>] kvm_set_shared_msr+0x32/0xa0 [kvm]
   [<ffffffffa03a103b>] vmx_set_msr+0x28b/0x2d0 [kvm_intel]
   ...

Making kvm_set_shared_msr() work in preemptible is cleaner, but
it's used in the fast path.  Making two variants is overkill, so
this patch just disables preemption around the call.
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>