This patch fixes some issues introduced in the rate control API rework.
When not running aggregation, copy bf->rates into info->control.rates
before applying the rate control status to it.
In ath_lookup_rate, the rates need to be pulled from bf->rates, not the
tx info.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

When aggregation stop is requested, don't run the mac80211 aggregation
stop callback yet, while the session is still blocked.
Also, when aggregation flush is requested, don't run the callback at all.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Manual peak calibration is currently enabled only for
AR9462 and AR9565. This is also required for AR9485.
The initvals are also modified to disable HW peak calibration.

Cc: <stable@vger.kernel.org>
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

This adds the USB ID of the On Networks N300MA, clone of Netgear WNA3100M.
Signed-off-by: Albert Pool <albertpool@solcon.nl>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: Ana Rey <Anazul77@hotmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

P2P_DEVICE support was removed from brcmfmac for v3.9 kernel with
the commit below:

commit 1527c343
Author: Arend van Spriel <arend@broadcom.com>
Date:   Thu Apr 4 12:10:11 2013 +0200

    brcmfmac: remove advertising P2P device support

However, it got merged into wireless-next. But for 3.10 brcmfmac does
support P2P device. Putting it back with this commit.
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

In http://lkml.indiana.edu/hypermail/linux/kernel/1305.1/index.html,
Geert Uytterhoeven reports a new warning when building 3.10-rc1 in
this driver. This is caused by using a "#if" test to see if __LITTLE_ENDIAN
is set, which fails for all big-endian systems. Change to "ifdef".
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Make sure that any open relayfs files are closed before
unregistering with mac80211, otherwise this crash is seen:

[ 1331.097846] BUG: unable to handle kernel paging request at 6b6b6b8b
[ 1331.098170] IP: [<c063d0d6>] debugfs_remove+0x26/0x80
[ 1331.098170] *pdpt = 000000002f9aa001 *pde = 0000000000000000
[ 1331.098170] Oops: 0000 [#1] PREEMPT SMP
[ 1331.098170] Modules linked in: iptable_raw xt_CT nf_conntrack_ipv4 nf_defrag]
[ 1331.098170] Pid: 4794, comm: rmmod Tainted: G        WC   3.9.1+ #5 To Be Fi.
[ 1331.098170] EIP: 0060:[<c063d0d6>] EFLAGS: 00010202 CPU: 0
[ 1331.098170] EIP is at debugfs_remove+0x26/0x80
[ 1331.098170] EAX: f2f3acd0 EBX: f2f3acd0 ECX: 00000006 EDX: f8622348
[ 1331.098170] ESI: 6b6b6b6b EDI: 00000001 EBP: ee251e14 ESP: ee251e0c
[ 1331.098170]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 1331.098170] CR0: 8005003b CR2: 6b6b6b8b CR3: 2e7b7000 CR4: 000007e0
[ 1331.098170] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 1331.098170] DR6: ffff0ff0 DR7: 00000400
[ 1331.098170] Process rmmod (pid: 4794, ti=ee250000 task=efaa2560 task.ti=ee25)
[ 1331.098170] Stack:
[ 1331.098170]  f241e170 0000000a ee251e1c f861394d ee251e28 c04e3088 f241e170 4
[ 1331.098170]  c04e30fe f45482b0 ee251e54 c04e3187 f25e86b0 ee251e54 f8618748 0
[ 1331.098170]  0000000a 00000001 ee251e68 f860065b f2509e20 f25085a0 f5b6e8a4 8
[ 1331.098170] Call Trace:
[ 1331.098170]  [<f861394d>] remove_buf_file_handler+0xd/0x20 [ath9k]
[ 1331.098170]  [<c04e3088>] relay_remove_buf+0x18/0x30
[ 1331.098170]  [<c04e30fe>] relay_close_buf+0x2e/0x40
[ 1331.098170]  [<c04e3187>] relay_close+0x77/0xf0
[ 1331.098170]  [<f8618748>] ? dpd_exit+0x38/0x40 [ath9k]
[ 1331.098170]  [<f860065b>] ath9k_deinit_softc+0x8b/0xa0 [ath9k]
[ 1331.098170]  [<f86006b8>] ath9k_deinit_device+0x48/0x60 [ath9k]
[ 1331.098170]  [<f86107f1>] ath_pci_remove+0x31/0x50 [ath9k]
[ 1331.098170]  [<c06dbff8>] pci_device_remove+0x38/0xc0
[ 1331.098170]  [<c079daa4>] __device_release_driver+0x64/0xc0
[ 1331.098170]  [<c079db97>] driver_detach+0x97/0xa0
[ 1331.098170]  [<c079cacc>] bus_remove_driver+0x6c/0xe0
[ 1331.098170]  [<c079c197>] ? bus_put+0x17/0x20
[ 1331.098170]  [<c079cae3>] ? bus_remove_driver+0x83/0xe0
[ 1331.098170]  [<c079e709>] driver_unregister+0x49/0x80
[ 1331.098170]  [<c06dc138>] pci_unregister_driver+0x18/0x80
[ 1331.098170]  [<f8610602>] ath_pci_exit+0x12/0x20 [ath9k]
[ 1331.098170]  [<f8619ce0>] ath9k_exit+0x17/0x337 [ath9k]
[ 1331.098170]  [<c09e537d>] ? mutex_unlock+0xd/0x10
[ 1331.098170]  [<c04bd36c>] sys_delete_module+0x17c/0x250
[ 1331.098170]  [<c0540dc4>] ? do_munmap+0x244/0x2d0
[ 1331.098170]  [<c0540e96>] ? vm_munmap+0x46/0x60
[ 1331.098170]  [<c09e8dc4>] ? restore_all+0xf/0xf
[ 1331.098170]  [<c09ebf50>] ? __do_page_fault+0x4c0/0x4c0
[ 1331.098170]  [<c04b18e4>] ? trace_hardirqs_on_caller+0xf4/0x180
[ 1331.098170]  [<c09ef28d>] sysenter_do_call+0x12/0x38
[ 1331.098170] Code: 90 8d 74 26 00 55 89 e5 83 ec 08 89 1c 24 89 74 24 04 3e 82
[ 1331.098170] EIP: [<c063d0d6>] debugfs_remove+0x26/0x80 SS:ESP 0068:ee251e0c
[ 1331.098170] CR2: 000000006b6b6b8b
[ 1331.727971] ---[ end trace b5bb9f2066cef7f9 ]---

Cc: <stable@vger.kernel.org>
Acked-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
Tested-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

If NO_DMA=y:

drivers/built-in.o: In function `ath9k_beacon_generate':
drivers/net/wireless/ath/ath9k/beacon.c:146: undefined reference to `dma_unmap_single'
drivers/net/wireless/ath/ath9k/beacon.c:174: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/beacon.c:176: undefined reference to `dma_mapping_error'
drivers/built-in.o: In function `ath9k_beacon_remove_slot':
drivers/net/wireless/ath/ath9k/beacon.c:252: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_descdma_setup':
drivers/net/wireless/ath/ath9k/init.c:382: undefined reference to `dmam_alloc_coherent'
drivers/built-in.o: In function `ath_edma_get_buffers':
drivers/net/wireless/ath/ath9k/recv.c:616: undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `ath_get_next_rx_buf':
drivers/net/wireless/ath/ath9k/recv.c:740: undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `ath_rx_edma_cleanup':
drivers/net/wireless/ath/ath9k/recv.c:176: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_rx_cleanup':
drivers/net/wireless/ath/ath9k/recv.c:340: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_rx_edma_buf_link':
drivers/net/wireless/ath/ath9k/recv.c:122: undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `ath_rx_tasklet':
drivers/net/wireless/ath/ath9k/recv.c:1275: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/recv.c:1277: undefined reference to `dma_mapping_error'
drivers/net/wireless/ath/ath9k/recv.c:1283: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_rx_edma_init':
drivers/net/wireless/ath/ath9k/recv.c:226: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/recv.c:229: undefined reference to `dma_mapping_error'
drivers/built-in.o: In function `ath_rx_init':
drivers/net/wireless/ath/ath9k/recv.c:303: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/recv.c:306: undefined reference to `dma_mapping_error'
drivers/built-in.o: In function `ath_tx_complete_buf':
drivers/net/wireless/ath/ath9k/xmit.c:2088: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_txstatus_setup':
drivers/net/wireless/ath/ath9k/xmit.c:2344: undefined reference to `dmam_alloc_coherent'
drivers/built-in.o: In function `ath_tx_set_retry':
drivers/net/wireless/ath/ath9k/xmit.c:307: undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `ath_tx_setup_buffer':
drivers/net/wireless/ath/ath9k/xmit.c:1887: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/xmit.c:1889: undefined reference to `dma_mapping_error'
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Cc: John W. Linville <linville@tuxdriver.com>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>

PCIe and ARM CR4 cores were found on 14e4:43b1 AKA BCM4352.
Reported-by: Gabriel Thörnblad <gabriel@thornblad.com>
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

EXPORT_SYMBOL and inline directives are contradictory to each other.
The patch fixes this inconsistency.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Denis Efremov <yefremov.denis@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Move the counter for non-AMPDU frames to mvm. It is needed
for the drain flow which happens once the ieee80211_sta has
been freed, so keeping it in iwl_mvm_sta which is embed into
ieee80211_sta is not a good idea.

Also, since its purpose it to remove the STA in the fw only
after all the frames for this station have exited the shared
Tx queues, we need to decrement it in the reclaim flow. This
flow can happen after ieee80211_sta has been removed, which
means that we have no iwl_mvm_sta there. So we can't know
what is the vif type. Hence, we know audit these frames for
all the vif types.
In order to avoid spawning sta_drained_wk all the time, we
now check that we are in a flow in which draining might
happen - only when mvmsta is NULL. This is better than
previous code that would spawn sta_drained_wk all the time
in AP mode.

Cc: stable@vger.kernel.org [3.9]
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

In the normal flow first MAC_CONTEXT_CMD for particular interface is
never sent while associated. The exception is fw restart flow when
resuming from suspend when WoWLAN is enabled. In this case successive
"add" and "modify" MAC_CONTEXT_CMD commands may be sent with assoc flag
set what cause FW mal functioning. To prevent this never set assoc flag
in MAC_CONTEXT_CMD with action "add".

Cc: stable@vger.kernel.org
Signed-off-by: Alexander Bondar <alexander.bondar@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Without this command, the firmware will filter out all the
multicast frames. Let them all in as for now. Later we will
want to optimize this to save power.

Cc: stable@vger.kernel.org
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

The FW AUX framework does not handle well cases where time events
fail to be scheduled (and as a result issues assert 0x3330). Until
a proper fix is in place, WA this by always setting the scan type to
SCAN_TYPE_FORCED.

Cc: stable@vger.kernel.org
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

The code sending the current WoWLAN TCP wakeup settings in
nl80211_send_wowlan_tcp() is not closing the nested attribute,
thus causing the parser to get confused on the receiver side
in userspace (iw). Fix this.

Cc: stable@vger.kernel.org [3.9]
Reported-by: Deepak Arora <deepakx.arora@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Even if the frame isn't transmitted to the AP, we need to
report it to cfg80211 so the state there can be updated
correctly.
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

When the interface goes down, there's no need to call
cfg80211_mlme_down() after __cfg80211_disconnect() as
the latter will call the former (if appropriate.)

Also, in __cfg80211_disconnect(), if the cfg80211 SME
isn't used, __cfg80211_disconnected() may still need
to be called (depending on the current state) so that
the SME state gets cleared.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

In AP mode, ignore frames with mis-matched BSSID that aren't
multicast or sent to the correct destination. This fixes
reporting public action frames to userspace multiple times
on multiple virtual AP interfaces.

Cc: stable@vger.kernel.org
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Adding the attributes fixes an issue with P2P Device not
working properly for management frame TX.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

ieee80211_get_tkip_p2k() may be called with interrupts
disabled, so spin_unlock_bh() isn't safe and leads to
warnings. Since it's always called with BHs disabled
already, just use spin_lock().

Cc: stable@vger.kernel.org
Reported-by: Milan Kocian <milon@wq.cz>
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Document rx vs tx status concurrency requirements.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

When an HT AP is advertising channel switch in a beacon, it
doesn't (and shouldn't, according to 802.11-2012 Table 8-20)
include a secondary channel offset element. The only possible
interpretation is that the previous secondary channel offset
remains valid, so use that when switching channel based only
on beacon information.

VHT requires the Wide Bandwidth Channel Switch subelement to
be present in the Channel Switch Wrapper element, so the code
for that is probably ok (see 802.11ac Draft 4, 8.4.2.165.)
Reported-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Since commit 12e7f517,
IEEE80211_SDATA_DISCONNECT_RESUME no longer worked as
it would simply never be tested. Restore a bit of the
code removed there and in 9b7d72c1
to make it work again.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

If the device reports a non-wireless wakeup reason, the
tracing code crashes trying to dereference a NULL pointer.
Fix this by checking the pointer on all accesses and also
add a non_wireless tag to the event.

Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Not registering a platform_driver would make us access garbage
when the platform callbacks under driver_register() kicks in.
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Tested-By: Martin Pitt <martin.pitt@ubuntu.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

If rfkill_register() fails in wiphy_register() the struct device
is unregistered but everything else isn't (regulatory, debugfs)
and we even leave the wiphy instance on all internal lists even
though it will likely be freed soon, which is clearly a problem.
Fix this by cleaning up properly.

Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

John W. Linville says:

====================
Here is a batch of fixes intended for the 3.10 stream.

Amitkumar Karwar provides an mwifiex fix to plug a memory leak when
the driver is unloaded.

Bing Zhao brings an mwifiex fix for some flag handling that leads to
log spam and an unusable interface.

Daniel Drake offers an mwifiex fix for multicast filter setup, to
correctly implement wakeup behaviour for multicast WOL.

Felix Fietkau fixes an ath9k problem that produces logspam and keycache
errors due to a bad return code.

Stanislaw Gruszka produces an fix for a WARNING from ath5k, and an
iwl4965 workaround to stop advertising a feature that doesn't work with
the current mac80211 implementation.

Sujith Manoharan gives us an ath9k fix to reprogram the HW beacon timers
after a TSF update, and an initvals fix for the AR9565 device.

Thommy Jakobsson fixes an rx descriptor underrun on b43.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

Pull trivial pstore update from Tony Luck:
 "Couple of pstore cleanups"

It turns out that the kmemdup() conversion ends up being undone by the
fact that the memory block also needed the ecc information (see commit
bd08ec33: "pstore/ram: Restore ecc information block"), so all that
remains after merging is the error return code change.

* tag 'please-pull-pstore' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux:
  pstore/ram: fix error return code in ramoops_probe()
  fs: pstore: Replaced calls to kmalloc and memcpy with kmemdup

Pull NVMe driver update from Matthew Wilcox:
 "Lots of exciting new features in the NVM Express driver this time,
  including support for emulating SCSI commands, discard support and the
  ability to submit per-sector metadata with I/Os.

  It's still mostly bugfixes though!"

* git://git.infradead.org/users/willy/linux-nvme: (27 commits)
  NVMe: Use user defined admin ioctl timeout
  NVMe: Simplify Firmware Activate code slightly
  NVMe: Only clear the enable bit when disabling controller
  NVMe: Wait for device to acknowledge shutdown
  NVMe: Schedule timeout for sync commands
  NVMe: Meta-data support in NVME_IOCTL_SUBMIT_IO
  NVMe: Device specific stripe size handling
  NVMe: Split non-mergeable bio requests
  NVMe: Remove dead code in nvme_dev_add
  NVMe: Check for NULL memory in nvme_dev_add
  NVMe: Fix error clean-up on nvme_alloc_queue
  NVMe: Free admin queue on request_irq error
  NVMe: Add scsi unmap to SG_IO
  NVMe: queue usage fixes in nvme-scsi
  NVMe: Set TASK_INTERRUPTIBLE before processing queues
  NVMe: Add a character device for each nvme device
  NVMe: Fix endian-related problems in user I/O submission path
  NVMe: Fix I/O cancellation status on big-endian machines
  NVMe: Fix sparse warnings in scsi emulation
  NVMe: Don't fail initialisation unnecessarily
  ...

Pull ACPICA fixes from Rafael Wysocki:

 - _INI regression fix from Tomasz Nowicki.

 - Fix for a possible memory leak in _OSI support routine from Jung-uk
   Kim.

 - Fix for a possible buffer overflow during field unit read operation
   from Bob Moore.

* tag 'acpi-fixes-3.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPICA: ACPICA: Fix for _INI regression
  ACPICA: _OSI support: Fix possible memory leak
  ACPICA: Fix possible buffer overflow during a field unit read operation

Pull ARM SoC fixes and straggler patches from Olof Johansson:
 "A collection of fixes for fall out from 3.10 merge window, some build
  fixes and warning cleanups and a small handful of patches that were
  small and contained and made sense to still include in 3.10 (some of
  these have also been in -next since the merge window opened).

  Largest continous series is for OMAP, but there's a handful for other
  platforms.

  For i.MX, one of the patches are framebuffer fixups due to fallout
  during the merge window, and the other removes some stale and broken
  code."

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (34 commits)
  ARM: exynos: dts: Fixed vbus-gpios
  ARM: EXYNOS5: Fix kernel dump in AFTR idle mode
  ARM: ux500: Rid ignored return value of regulator_enable() compiler warning
  ARM: ux500: read the correct soc_id number
  ARM: exynos: dts: cros5250: add cyapa trackpad
  video: mxsfb: Adapt to new videomode API
  ARM: imx: Select GENERIC_ALLOCATOR
  ARM: imx: compile fix for hotplug.c
  ARM: dts: don't assume boards are using twl4030 for omap3
  ARM: OMAP2+: Remove bogus IS_ERR_OR_NULL checking from id.c
  ARM: dts: Configure and fix the McSPI pins for 4430sdp
  ARM: dts: AM33XX: Add GPMC node
  ARM: dts: OMAP4460: Fix CPU OPP voltages
  ARM: dts: OMAP36xx: Fix CPU OPP voltages
  ARM: OMAP4+: omap2plus_defconfig: Enable audio via TWL6040 as module
  ARM: OMAP2: AM33XX: id: Add support for new AM335x PG2.1 Si
  omap: mux: add AM/DM37x gpios
  ARM: OMAP1: DMA: fix error handling in omap1_system_dma_init()
  ARM: OMAP2+: omap_device: use late_initcall_sync
  ARM: OMAP: RX-51: change probe order of touchscreen and panel SPI devices
  ...

Pull xtensa updates from Chris Zankel:
 "Support for the latest MMU architecture that allows for a larger
  accessible memory region, and various bug-fixes"

* tag 'xtensa-next-20130508' of git://github.com/czankel/xtensa-linux:
  xtensa: Switch to asm-generic/linkage.h
  xtensa: fix redboot load address
  xtensa: ISS: fix timer_lock usage in rs_open
  xtensa: disable IRQs while IRQ handler is running
  xtensa: enable lockdep support
  xtensa: fix arch_irqs_disabled_flags implementation
  xtensa: add irq flags trace support
  xtensa: provide custom CALLER_ADDR* implementations
  xtensa: add stacktrace support
  xtensa: clean up stpill_registers
  xtensa: don't use a7 in simcalls
  xtensa: don't attempt to use unconfigured timers
  xtensa: provide default platform_pcibios_init implementation
  xtensa: remove KCORE_ELF again
  xtensa: document MMUv3 setup sequence
  xtensa: add MMU v3 support
  xtensa: fix ibreakenable register update
  xtensa: fix oprofile building as module

Pull ARC port updates from Vineet Gupta:
 "Support for two new platforms based on ARC700:
   - Abilis TB10x SoC [Chritisian/Pierrick]
   - Simulator only System-C Model [Mischa]

  ARC specific MM improvements:
   - Avoid full TLB flush (ASID increment) on munmap (even single page)
   - VIPT Cache Flushing improvements
     + Delayed dcache flush for non-aliasing dcache (big performance boost)
     + icache flush aliasing agnostic (no need to kill all possible aliases)

  Others:
   - Avoid needless rebuild of DTB files for every kernel build
   - Remove builtin cmdline as that is already provided by DeviceTree/bootargs
   - Fixing unaligned access emulation corner case
   - checkpatch fixes [Sachin]
   - Various fixlets [Noam]
   - Minor build failures/cleanups"

* tag 'arc-v3.10-rc1-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: (35 commits)
  ARC: [mm] Lazy D-cache flush (non aliasing VIPT)
  ARC: [mm] micro-optimize page size icache invalidate
  ARC: [mm] remove the pessimistic all-alias-invalidate icache helpers
  ARC: [mm] consolidate icache/dcache sync code
  ARC: [mm] optimise icache flush for kernel mappings
  ARC: [mm] optimise icache flush for user mappings
  ARC: [mm] optimize needless full mm TLB flush on munmap
  ARC: Add support for nSIM OSCI System C model
  ARC: [TB10x] Adapt device tree to new compatible string
  ARC: [TB10x] Add support for TB10x platform
  ARC: [TB10x] Device tree of TB100 and TB101 Development Kits
  ARC: Prepare interrupt code for external controllers
  ARC: Allow embedded arc-intc to be properly placed in DT intc hierarchy
  ARC: [cmdline] Don't overwrite u-boot provided bootargs
  ARC: [cmdline] Remove CONFIG_CMDLINE
  ARC: [plat-arcfpga] defconfig update
  ARC: unaligned access emulation broken if callee-reg dest of LD/ST
  ARC: unaligned access emulation error handling consolidation
  ARC: Debug/crash-printing Improvements
  ARC: fix typo with clock speed
  ...

Pull tile update from Chris Metcalf:
 "The interesting bug fix is support for the upcoming "4.2" release of
  the Tilera hypervisor, which by default launches Linux at privilege
  level 2 instead of 1.  The fix lets new and old hypervisors and
  Linuxes interoperate more smoothly, so I've tagged it for
  stable@kernel.org so that older Linuxes will be able to boot under the
  newer hypervisor."

* 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
  usb: tilegx: fix memleak when create hcd fail
  arch/tile: remove inline marking of EXPORT_SYMBOL functions
  rtc: rtc-tile: add missing platform_device_unregister() when module exit
  tile: support new Tilera hypervisor

Dave reported an oops triggered by trinity:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
  IP: newseg+0x10d/0x390
  PGD cf8c1067 PUD cf8c2067 PMD 0
  Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
  CPU: 2 PID: 7636 Comm: trinity-child2 Not tainted 3.9.0+#67
  ...
  Call Trace:
    ipcget+0x182/0x380
    SyS_shmget+0x5a/0x60
    tracesys+0xdd/0xe2

This bug was introduced by commit af73e4d9 ("hugetlbfs: fix mmap
failure in unaligned size request").
Reported-by: Dave Jones <davej@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Li Zefan <lizfan@huawei.com>
Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Acked-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The semctl GETNCNT returns the number of semops waiting for the
specified semaphore to become nonzero.  After commit 9f1bc2c9
("ipc,sem: have only one list in struct sem_queue"), the semops waiting
on just one semaphore are waiting on that semaphore's list.

In order to return the correct count, we have to walk that list too, in
addition to the sem_array's list for complex operations.
Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The semctl GETZCNT returns the number of semops waiting for the
specified semaphore to become zero.  After commit 9f1bc2c9
("ipc,sem: have only one list in struct sem_queue"), the semops waiting
on just one semaphore are waiting on that semaphore's list.

In order to return the correct count, we have to walk that list too, in
addition to the sem_array's list for complex operations.

This bug broke dbench; it works again with this patch applied.
Signed-off-by: Rik van Riel <riel@redhat.com>
Reported-by: Kent Overstreet <koverstreet@google.com>
Tested-by: Kent Overstreet <koverstreet@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull more vfs fixes from Al Viro:
 "Regression fix from Geert + yet another open-coded kernel_read()"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  ecryptfs: don't open-code kernel_read()
  xtensa simdisk: Fix proc_create_data() conversion fallout