Merge tag 'trace-fixes-v3.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace

Pull tracing fixes from Steven Rostedt:
 "Two more fixes:

  The first one was reported by Mauro Carvalho Chehab, where if a poll()
  is done against a trace buffer for a CPU that has never been online,
  it will crash the kernel, as buffers are only created when a CPU comes
  on line, but the trace files are for all possible CPUs.

  This fix is to check if the buffer was allocated and if not return
  -EINVAL.

  That was the simple fix, the real fix is a bit more complex and not
  for a -rc release.  We could have the files created when the CPUs come
  online.  That would require some design changes.

  The second one was reported by Peter Zijlstra.  If the kernel command
  line has ftrace=nop, it will lock up the system on boot up.  This is
  because the new design for 3.10 has the nop tracer bootstrap the
  tracing subsystem.  When ftrace=<trace> is defined, when a that tracer
  is registered, it starts the tracing, but uses the nop tracer to clear
  things out.  What happened here was that ftrace=nop caused the
  registering of nop to start it and use nop before it was initialized.

  The only thing nop needs to have done to initialize it is to have the
  tracer point its current_tracer structure member to the nop tracer.
  Doing that before registering the nop tracer makes everything work."

* tag 'trace-fixes-v3.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
  ring-buffer: Do not poll non allocated cpu buffers
  tracing: Fix crash when ftrace=nop on the kernel command line
net/9p: Handle error in zero copy request correctly for 9p2000.u

For zero copy request, error will be encoded in the user space buffer.
So copy the error code correctly using copy_from_user. Here we use the
extra bytes we allocate for zero copy request. If total error details
are more than P9_ZC_HDR_SZ - 7 bytes, we return -EFAULT. The patch also
avoid a memory allocation in the error path.

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Merge branch 'for-3.10' of git://git.samba.org/sfrench/cifs-2.6

Pull CIFS fixes from Steve French:
 "Fixes for a couple of DFS problems, a problem with extended security
  negotiation and two other small cifs fixes"

* 'for-3.10' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: fix composing of mount options for DFS referrals
  cifs: stop printing the unc= option in /proc/mounts
  cifs: fix error handling when calling cifs_parse_devname
  cifs: allow sec=none mounts to work against servers that don't support extended security
  cifs: fix potential buffer overrun when composing a new options string
  cifs: only set ops for inodes in I_NEW state
Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fixes from Herbert Xu:
 "This push fixes a crash in the new sha256_ssse3 driver as well as a
  DMA setup/teardown bug in caam"

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: sha256_ssse3 - fix stack corruption with SSSE3 and AVX implementations
  crypto: caam - fix inconsistent assoc dma mapping direction
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux

Pull drm fixes from Dave Airlie:
 "This is mostly exynos and intel fixes, along with some vblank patches
  I lost from Rob a few months ago that make wayland work better on lots
  of GPUs, also a qxl kconfig fix."

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (22 commits)
  qxl: fix Kconfig deps - select FB_DEFERRED_IO
  drm/exynos: replace request_threaded_irq with devm function
  drm/exynos: remove unnecessary devm_kfree
  drm/exynos: fix build warnings from ipp fimc
  drm/exynos: cleanup device pointer usages
  drm/exynos: wait for the completion of pending page flip
  drm/exynos: use drm_send_vblank_event() helper
  drm/i915: avoid premature DP AUX timeouts
  drm/i915: avoid premature timeouts in __wait_seqno()
  drm/i915: use msecs_to_jiffies_timeout instead of open coding the same
  drm/i915: add msecs_to_jiffies_timeout to guarantee minimum duration
  drm/i915: force full modeset if the connector is in DPMS OFF mode
  drm/exynos: page flip fixes
  drm/exynos: exynos_hdmi: Pass correct pointer to free_irq()
  drm/exynos: exynos_drm_ipp: Fix incorrect usage of IS_ERR_OR_NULL
  drm/exynos: exynos_drm_fbdev: Fix incorrect usage of IS_ERR_OR_NULL
  drm/imx: use drm_send_vblank_event() helper
  drm/shmob: use drm_send_vblank_event() helper
  drm/radeon: use drm_send_vblank_event() helper
  drm/nouveau: use drm_send_vblank_event() helper
  ...
Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes
brcmfmac: Turn off ARP offloading when configured for AP.

ARP offloading should only be used in STA or P2P client mode. It
is currently configured once at init. When being configured for AP
ARP offloading should be turned off and when AP mode is left it can
be turned back on.

Cc: stable@vger.kernel.org
Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
brcmfmac: Fix p2p setup when connected to ap on 5G.

The firmware requires that on p2p setup when net interfaces
are created or updated that they start initially with the same
channel as the channel in use for the current connection
(if any). If none exists take default channel 11.

Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
brcmfmac: add additional parameter to brcmf_free_vif()

Pass the struct brcmf_cfg80211_info instance instead of obtaining
through vif itself using vif->wdev. This is needed as the netdev
associated with this vif is already unregistered.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
brcmfmac: free net device when registration fails

When registration fails the net device is no longer needed. Free
the net device and remove reference to private data from the
driver.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
brcmfmac: use struct net_device::destructor to remove interfaces

Upon deleting a P2P_CLIENT/GO interface the vif and consequently
the wdev is freed before the net_device is actually being unregistered
but cfg80211 still needs to access the wdev. Using destructor field
to free the net_device and vif.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
brcmfmac: Add multi channel support for P2P.

Multi channel support was disabled. This patch will enable it and
configure the P2P GO on the correct frequency when multi channel
is used.

Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
brcmfmac: Disable powersave mode for P2P link.

For p2p client mode powersave mode should be kept disabled. It is
working but inefficient. In general p2p links do no benefit from this
mode, because these links are setup temporarily to transfer data.

Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
ath9k: use correct OTP register offsets for AR9550

Accessing the OTP memory on AR9950 causes a data bus
like this:

  Data bus error, epc == 801f7774, ra == 801f7774
  Oops[#1]:
  CPU: 0 PID: 1 Comm: swapper Not tainted 3.10.0-rc3 #592
  task: 87c28000 ti: 87c22000 task.ti: 87c22000
  $ 0   : 00000000 00000061 deadc0de 00000000
  $ 4   : b8115f18 00015f18 00000007 00000004
  $ 8   : 00000001 7c7c3c7c 7c7c7c7c 7c7c7c7c
  $12   : 7c7c3c7c 80320a68 00000000 7c7c7c3c
  $16   : 87cd8010 00015f18 00000007 00000000
  $20   : 00000064 00000004 87c23c7c 8035210c
  $24   : 00000000 801f3674
  $28   : 87c22000 87c23b48 00000001 801f7774
  Hi    : 00000000
  Lo    : 00000064
  epc   : 801f7774 ath9k_hw_wait+0x58/0xb0
      Not tainted
  ra    : 801f7774 ath9k_hw_wait+0x58/0xb0
  Status: 1000cc03 KERNEL EXL IE
  Cause : 4080801c
  PrId  : 00019750 (MIPS 74Kc)
  Modules linked in:
  Process swapper (pid: 1, threadinfo=87c22000, task=87c28000, ts=00000000)
  Stack : 0000000f 00000061 00002710 8006240c 00000001 87cd8010 87c23bb0 87cd8010
          00000000 00000004 00000003 80210c7c 000000b3 67fa8000 0000032a 000006fe
          000003e8 00000002 00000028 87c23bf0 000003ff 80210d24 803e5630 80210e28
          00000000 00000007 87cd8010 00007044 00000004 00000061 000003ff 000001ff
          87c26000 87cd8010 00000220 87cd8bb8 80210000 8020fcf4 87c22000 87c23c08
          ...
  Call Trace:
  [<801f7774>] ath9k_hw_wait+0x58/0xb0
  [<80210c7c>] ar9300_otp_read_word+0x80/0xd4
  [<80210d24>] ar9300_read_otp+0x54/0xb0
  [<8020fcf4>] ar9300_check_eeprom_header+0x1c/0x40
  [<80210fe4>] ath9k_hw_ar9300_fill_eeprom+0x118/0x39c
  [<80206650>] ath9k_hw_eeprom_init+0x74/0xb4
  [<801f96d0>] ath9k_hw_init+0x7ec/0x96c
  [<801e65ec>] ath9k_init_device+0x340/0x758
  [<801f35d0>] ath_ahb_probe+0x21c/0x2c0
  [<801c041c>] driver_probe_device+0xc0/0x1e4
  [<801c05ac>] __driver_attach+0x6c/0xa4
  [<801bea08>] bus_for_each_dev+0x64/0xa8
  [<801bfa40>] bus_add_driver+0xcc/0x24c
  [<801c0954>] driver_register+0xbc/0x17c
  [<803f8fc0>] ath9k_init+0x5c/0x88
  [<800608fc>] do_one_initcall+0xec/0x1a0
  [<803e6a68>] kernel_init_freeable+0x13c/0x200
  [<80309cdc>] kernel_init+0x1c/0xe4
  [<80062450>] ret_from_kernel_thread+0x10/0x18

On the AR9550, the OTP registers are located at
the same address as on the AR9340. Use the correct
values to avoid the error.

Cc: stable@vger.kernel.org  # 3.6+
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
usb: dwc3: pci: PHY should be deleted later than dwc3 core

If the glue layer is removed first (core layer later),
it deletes the phy device first, then the core device.
But at core's removal, it still uses PHY's resources, it may
cause kernel's oops. It is much like the problem
Paul Zimmerman reported at:
http://marc.info/?l=linux-usb&m=136547502011472&w=2.

Besides, it is reasonable the PHY is deleted at last as
the controller is the PHY's user.

Signed-off-by: Peter Chen <peter.chen@freescale.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: dwc3: exynos: PHY should be deleted later than dwc3 core

If the glue layer is removed first (core layer later),
it deletes the phy device first, then the core device.
But at core's removal, it still uses PHY's resources, it may
cause kernel's oops. It is much like the problem
Paul Zimmerman reported at:
http://marc.info/?l=linux-usb&m=136547502011472&w=2.

Besides, it is reasonable the PHY is deleted at last as
the controller is the PHY's user.

Signed-off-by: Peter Chen <peter.chen@freescale.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: dwc3: gadget: free trb pool only from epnum 2

we never allocate a TRB pool for physical endpoints
0 and 1 so trying to free it (a invalid TRB pool pointer)
will lead us in a warning while removing dwc3.ko module.

In order to fix the situation, all we have to do is skip
dwc3_free_trb_pool() for physical endpoints 0 and 1 just
as we while deleting endpoints from the endpoints list.

Cc: stable@vger.kernel.org
Signed-off-by: George Cherian <george.cherian@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: musb: make use_sg flag URB specific

Since highmem PIO URB handling was introduced in:

8e8a551 usb: musb: host: Handle highmem in PIO mode

when a URB is being handled it may happen that the static use_sg flag
was set by a previous URB with buffer in highmem.  This leads to error
in handling the present URB.

Fix this by making the use_sg flag URB specific.

Cc: stable <stable@vger.kernel.org> # 3.7+
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Virupax Sadashivpetimath <virupax.sadashivpetimath@stericsson.com>
Signed-off-by: Fabio Baltieri <fabio.baltieri@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
ntp: Remove unused variable flags in __hardpps

kernel/time/ntp.c: In function ‘__hardpps’:
kernel/time/ntp.c:877: warning: unused variable ‘flags’

commit a076b2146fabb0894cae5e0189a8ba3f1502d737 ("ntp: Remove ntp_lock,
using the timekeeping locks to protect ntp state") removed its users,
but not the actual variable.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>