Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus

Pull MIPS fixes from Ralf Baechle:
 "MIPS fixes for 3.11.  Half of then is for Netlogic the remainder
  touches things across arch/mips.

  Nothing really dramatic and by rc1 standards MIPS will be in fairly
  good shape with this applied.  Tested by building all MIPS defconfigs
  of which with this pull request four platforms won't build.  And yes,
  it boots also on my favorite test systems"

* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
  MIPS: kvm: Kconfig: Drop HAVE_KVM dependency from VIRTUALIZATION
  MIPS: Octeon: Fix DT pruning bug with pip ports
  MIPS: KVM: Mark KVM_GUEST (T&E KVM) as BROKEN_ON_SMP
  MIPS: tlbex: fix broken build in v3.11-rc1
  MIPS: Netlogic: Add XLP PIC irqdomain
  MIPS: Netlogic: Fix USB block's coherent DMA mask
  MIPS: tlbex: Fix typo in r3000 tlb store handler
  MIPS: BMIPS: Fix thinko to release slave TP from reset
  MIPS: Delete dead invocation of exception_exit().
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml

Pull UML fixes from Richard Weinberger:
 "Special thanks goes to Toralf Föster for continuously testing UML and
  reporting issues!"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml:
  um: remove dead code
  um: siginfo cleanup
  uml: Fix which_tmpdir failure when /dev/shm is a symlink, and in other edge cases
  um: Fix wait_stub_done() error handling
  um: Mark stub pages mapping with VM_PFNMAP
  um: Fix return value of strnlen_user()
allow O_TMPFILE to work with O_WRONLY

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
vxlan: unregister on namespace exit

Fix memory leaks and other badness from VXLAN network namespace
teardown. When network namespace is removed, all the vxlan devices should
be unregistered (not closed).

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Reviewed-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
vxlan: fix igmp races

There are two race conditions in existing code for doing IGMP
management in workqueue in vxlan. First, the vxlan_group_used
function checks the list of vxlan's without any protection, and
it is possible for open followed by close to occur before the
igmp work queue runs.

To solve these move the check into vxlan_open/stop so it is
protected by RTNL. And split into two work structures so that
there is no racy reference to underlying device state.

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
qlcnic: Fix invalid register offset calculation

83xx adapter specific code was accessing 82xx register which
resulted in invalid register offset. This patch uses proper
register access method.

Signed-off-by: Shahed Shaikh <shahed.shaikh@qlogic.com>
Signed-off-by: Jitendra Kalsaria <jitendra.kalsaria@qlogic.com>
Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
qlcnic: Set __QLCNIC_DEV_UP in adapter state before enabling interrupts

NAPI poll function does not re-enable the interrupt, if __QLCNIC_DEV_UP is not set
in adapter state. This was preventing driver from receiving any packet.

Signed-off-by: Pratik Pujar <pratik.pujar@qlogic.com>
Signed-off-by: Jitendra Kalsaria <jitendra.kalsaria@qlogic.com>
Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
qlcnic: Fix NULL pointer dereference in VF probe path.

o Check for non-NULL set_mac_filter_count function pointer
  before calling it fixes the panic.

This patch fixes regression introduced by patch
"qlcnic: Secondary unicast MAC address support." with
commit id 168e4fb54c11865668ad50eff81b5f2729e0e0f4.

Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
qlcnic: Fix multicast packet handling for PF and VF.

o Multicast MAC was not getting programmed due to which multicast
  packets were being dropped by FW.

This patch fixes commit 168e4fb54c11865668ad50eff81b5f2729e0e0f4
("qlcnic: Secondary unicast MAC address support.") which introduced
bug in handling multicast packets.

Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
qlcnic: Fix panic while setting VF's MAC address

o "qlcnic_sriov" structure pointer should be accessed only
  when SR-IOV is enabled. Access this pointer after SR-IOV
  PF check.

Signed-off-by: Manish Chopra <manish.chopra@qlogic.com>
Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
qlcnic: Fix ethtool display for 83xx adapter.

o Commit b938662d88264c1a92611ca1b82fdff5a4e87121
  ("qlcnic: Fix ethtool supported port status for 83xx")
  introduced regression for display of link status for 83xx
  adapter while refactoring port status display. This patch
  is to fix the link status display for 83xx adapter.

Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
qlcnic: Fix dump template version mask

Driver was using wrong mask for template version.

Signed-off-by: Shahed Shaikh <shahed.shaikh@qlogic.com>
Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
qlcnic: Fix releasing of Tx frag which was never mapped.

o Driver was freeing Tx frag which was never mapped before which
  result into panic as kernel was unable to handle paging request.

BUG: unable to handle kernel paging request at ffffc9002552a000
IP: [<ffffffffa05ed762>] qlcnic_release_tx_buffers+0x72/0x170 [qlcnic]
PGD 87fc15067 PUD 47febf067 PMD 4758c5067 PTE 0
Oops: 0000 [#1] SMP

crash> bt
PID: 27343  TASK: ffff8802a5de8080  CPU: 27  COMMAND: "ifconfig"
   [ffff8802a34b3850] machine_kexec at ffffffff81035b7b
   [ffff8802a34b38b0] crash_kexec at ffffffff810c0db2
   [ffff8802a34b3980] oops_end at ffffffff815111d0
   [ffff8802a34b39b0] no_context at ffffffff81046bfb
   [ffff8802a34b3a00] __bad_area_nosemaphore at ffffffff81046e85
   [ffff8802a34b3a50] bad_area_nosemaphore at ffffffff81046f53
   [ffff8802a34b3a60] __do_page_fault at ffffffff810476b1
   [ffff8802a34b3b80] do_page_fault at ffffffff8151311e
   [ffff8802a34b3bb0] page_fault at ffffffff815104d5
    [exception RIP: qlcnic_release_tx_buffers+114]
    RIP: ffffffffa05ed762  RSP: ffff8802a34b3c68  RFLAGS: 00010246
    RAX: ffff88087989c000  RBX: ffffc90025529ff8  RCX: 0000000000000001
    RDX: 0000000000000013  RSI: 0000000000000013  RDI: 0000000000000000
    RBP: ffff8802a34b3ca8   R8: 0000000000000000   R9: 0000000000000000
    R10: 000000000000000c  R11: 0000000000000000  R12: 0000000000000012
    R13: ffffc90025529ec0  R14: ffff880761e876e0  R15: 00000000000003ff
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
   [ffff8802a34b3cb0] __qlcnic_down at ffffffffa05e8b15 [qlcnic]
   [ffff8802a34b3d00] qlcnic_close at ffffffffa05e8b78 [qlcnic]
   [ffff8802a34b3d10] dev_close at ffffffff81449d81
   [ffff8802a34b3d30] dev_change_flags at ffffffff814495c1

Signed-off-by: Jitendra Kalsaria <jitendra.kalsaria@qlogic.com>
Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
qlcnic: Fix guest VLAN

o Clear cached vport vlan variable(vp->vlan) in PF on PCI FLR and
  back-channel termination which will allow to configure guest VLAN
  on VF after force off/shut down the guest VM.

Signed-off-by: Manish Chopra <manish.chopra@qlogic.com>
Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
veth: add vlan features

The veth device doesn't provide the vlan features,
so TSO for example is disabled and that causes
performance issues when using tagged traffic.

The test topology looks like this:

    br0                     br1
  /   \                  /     \
vnet  veth0.10 ----- veth1.10   vnet
VM                               VM

The netperf results with current veth driver:
MIGRATED TCP STREAM TEST from 192.168.1.1 ()
port 0 AF_INET to 192.168.1.2 () port 0 AF_INET
Recv   Send    Send
Socket Socket  Message  Elapsed
Size   Size    Size     Time     Throughput
bytes  bytes   bytes    secs.    10^6bits/sec

 87380  16384  16384    10.01    2210.22

Now after applying the proposed patch:
MIGRATED TCP STREAM TEST from 192.168.1.1 ()
port 0 AF_INET to 192.168.1.2 () port 0 AF_INET
Recv   Send    Send
Socket Socket  Message  Elapsed
Size   Size    Size     Time     Throughput
bytes  bytes   bytes    secs.    10^6bits/sec

 87380  16384  16384    10.00    13067.47

Signed-off-by: Flavio Leitner <fbl@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
arcnet: cleanup sizeof parameter

This patch doesn't change the compiled code because ARC_HDR_SIZE is 4
and sizeof(int) is 4, but the intent was to use the header size and not
the sizeof the header size.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
sysctl net: Keep tcp_syn_retries inside the boundary

Limit the min/max value passed to the
/proc/sys/net/ipv4/tcp_syn_retries.

Signed-off-by: Michal Tesar <mtesar@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
livelock avoidance in sget()

Eric Sandeen has found a nasty livelock in sget() - take a mount(2) about
to fail.  The superblock is on ->fs_supers, ->s_umount is held exclusive,
->s_active is 1.  Along comes two more processes, trying to mount the same
thing; sget() in each is picking that superblock, bumping ->s_count and
trying to grab ->s_umount.  ->s_active is 3 now.  Original mount(2)
finally gets to deactivate_locked_super() on failure; ->s_active is 2,
superblock is still ->fs_supers because shutdown will *not* happen until
->s_active hits 0.  ->s_umount is dropped and now we have two processes
chasing each other:
s_active = 2, A acquired ->s_umount, B blocked
A sees that the damn thing is stillborn, does deactivate_locked_super()
s_active = 1, A drops ->s_umount, B gets it
A restarts the search and finds the same superblock.  And bumps it ->s_active.
s_active = 2, B holds ->s_umount, A blocked on trying to get it
... and we are in the earlier situation with A and B switched places.

The root cause, of course, is that ->s_active should not grow until we'd
got MS_BORN.  Then failing ->mount() will have deactivate_locked_super()
shut the damn thing down.  Fortunately, it's easy to do - the key point
is that grab_super() is called only for superblocks currently on ->fs_supers,
so it can bump ->s_count and grab ->s_umount first, then check MS_BORN and
bump ->s_active; we must never increment ->s_count for superblocks past
->kill_sb(), but grab_super() is never called for those.

The bug is pretty old; we would've caught it by now, if not for accidental
exclusion between sget() for block filesystems; the things like cgroup or
e.g. mtd-based filesystems don't have anything of that sort, so they get
bitten.  The right way to deal with that is obviously to fix sget()...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
vfs: constify dentry parameter in d_count()

so that it can be used in places like d_compare/d_hash
without causing a compiler warning.

Signed-off-by: Peng Tao <tao.peng@emc.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
bridge: do not call setup_timer() multiple times

commit 9f00b2e7cf24 ("bridge: only expire the mdb entry when query is
received") added a nasty bug as an active timer can be reinitialized.

setup_timer() must be done once, no matter how many time mod_timer()
is called. br_multicast_new_group() is the right place to do this.

Reported-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Diagnosed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Cc: Cong Wang <amwang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>