Receive DMA maps are oversized, they include EISA legacy 128-byte
alignment padding in size calculation whereas this padding is never used
for data.  Worse yet, if the skb's data area has been realigned indeed,
then data beyond the end of the buffer will be synchronised from the
receive DMA bounce buffer, possibly corrupting data structures residing
in memory beyond the actual end of this data buffer.

Therefore switch to using PI_RCV_DATA_K_SIZE_MAX rather than NEW_SKB_SIZE
in DMA mapping, the value the former macro expands to is written to the
receive ring DMA descriptor of the PDQ DMA chip and determines the
maximum amount of data PDQ will ever transfer to the corresponding data
buffer, including all headers and padding.
Reported-by: Robert Coerver <Robert.Coerver@ll.mit.edu>
Tested-by: Robert Coerver <Robert.Coerver@ll.mit.edu>
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

David Laight says:

====================
net: sctp: Optimisations to sctp command queue code

These 3 patches optimise the code that processes sctp's command queue.
(A list of 'tasks' to be performed after the rest of the chunk processing.)

1) Inline all the functions from command.c
2) Remove the memset() calls used to zero a word-sized union.
3) Use pointers instead of array indexes.

The combined changes reduce the code size (amd64) by a few kb.

I'm not 100% convinced that the zeroing done in patch 2 is needed at all.
On BE systems it is likely to generate more code than on LE ones.
In fact it might be best to change the union to only contain 'long' sized
items.

Changes for v2:
	- Add some missing initialisers in patch 2/3 and delete them in 3/3.
	- Modify the commit message for 2/3 to point out that the union
	  shouldn't need to be zeroed, but the patches aren't intended to
	  change the behaviour even if the code is buggy.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

Using pointers into sctp_cmd_seq_t.cmds[] lets the compiler generate much
better code.
Use the last entry first to optimise the overflow check.
Signed-off-by: David Laight <david.laight@aculab.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Even if memset() is inlined (as on x86) using it to zero the union
generates a memory word write of zero, followed by a write of the
smaller field, and then a read of the word.
As well as being a lot of instructions the sequence is unlikely to
be optimised by the store-load forward hardware so will be slow.

Instead allocate a field of the union that is the same size as the
entire union and write a zero value to it. The compiler will then
generate the required value in a register.

Zeroing the union shouldn't be necessary, but this patch series isn't
intended to have a behavioural change.
Signed-off-by: David Laight <david.laight@aculab.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

sctp_init_cmd_seq() and sctp_next_cmd() are only called from one place.
The call sequence for sctp_add_cmd_sf() is likely to be longer than
the inlined code.
With sctp_add_cmd_sf() inlined the compiler can optimise repeated calls.
Signed-off-by: David Laight <david.laight@aculab.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This warning is introduced by commit 7b30600c ("appletalk:
fix checkpatch error with indent"), So fix it.
Signed-off-by: Wang Weidong <wangweidong1@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

John W. Linville says:

====================
pull request: wireless-next 2014-07-03

Please pull this first batch of wireless updates intended for the
3.17 stream...

For the mac80211 bits, Johannes says:

"The biggest thing here is probably Arik's TDLS rework, beyond that we
have smaller improvements and features like David's scanning IE thing,
Luca's queue work, some CSA work, etc. Also your PID rate control
removal, of course."

For the iwlwifi bits, Emmanuel says:

"I have here a whole bunch of various things. Andy contributes
better debug prints for dvm specific flows and a module parameter to
completely disable power save for dvm. Andrei is sharing the premises
of his work on CSA - more to come. Eran and Liad keep on working
on the new devices. I have the regular amount of BT Coex stuff and
I continue to work on the firmware error report system adding more
debug capabilities. More to come on that subject too."

On top of that, there are some cleanups to the new rsi driver, some
continuing improvements to the rtl818x drivers, and the usual bundles
of updates to ath9k, b43, mwifiex, wil6210, and a few other bits here
and there.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

load_pointer() is already a static inline function.
Let's move it into filter.h so BPF JIT implementations can reuse this
function.

Since we're exporting this function, let's also rename it to
bpf_load_pointer() for clarity.
Signed-off-by: Zi Shen Lim <zlim.lnx@gmail.com>
Reviewed-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This fixes compiler warnings:

drivers/net/ethernet/amd/declance.c: In function 'lance_init_ring':
drivers/net/ethernet/amd/declance.c:478: warning: format '%8.8x' expects type 'unsigned int', but argument 3 has type 'long unsigned int'
drivers/net/ethernet/amd/declance.c:487: warning: format '%8.8x' expects type 'unsigned int', but argument 3 has type 'long unsigned int'
drivers/net/ethernet/amd/declance.c:503: warning: cast from pointer to integer of different size
drivers/net/ethernet/amd/declance.c:520: warning: cast from pointer to integer of different size

in 64-bit compilation.  Where the value printed is an offset (whose range
will always fit) the cast uses a 32-bit type, otherwise, where it is a
host memory address, the pointer is output directly with %p.  Also the
remaining `0x' prefix is dropped for consistency across these messages.

Tested with both 32-bit and 64-bit compilation, as well as at the run time
(with the debug messages affected enabled).
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Arvid Brodin says:

====================
net/hsr: Use list_head+rcu, better frame dispatch, etc.

This patch series is meant to improve the HSR code in several ways:

* Better code readability.
* In general, make the code structure more like the net/bridge code (HSR
  operates similarly to a bridge, but uses the HSR-specific frame headers to
  break up rings, instead of the STP protocol).
* Better handling of HSR ports' net_device features.
* Use list_head and the _rcu list traversing routines instead of array of slave
  devices.
* Make it easy to support HSR Interlink devices (for future Redbox/Quadbox
  support).
* Somewhat better throughput on non-HAVE_EFFICIENT_UNALIGNED_ACCESS archs, due
  to lesser copying of skb data.

The code has been tested in a ring together with other HSR nodes running
unchanged code, on both avr32 and x86_64. There should only be one minor change
in behaviour from a user perspective:

* Anyone using the Netlink HSR_C_GET_NODE_LIST message to dump the internal
  node database will notice that the database now also contains the self node.

All patches pass 'checkpatch.pl --ignore CAMELCASE --max-line-length=83
--strict' with only CHECKs, each of which have been deliberately left in place.

The final code passes sparse checks with no output.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

If none of the slave interfaces are specified, struct nlattr *data[] may
be NULL. Make sure to check for that.

While I'm at it, fix the horrible error messages displayed when only one
of the slave interfaces isn't specified.
Signed-off-by: Arvid Brodin <arvid.brodin@alten.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch removes the separate paths for frames coming from the outside, and
frames sent from the HSR device, and instead makes all frames go through
hsr_forward_skb() in hsr_forward.c. This greatly improves code readability and
also opens up the possibility for future support of the HSR Interlink device
that is the basis for HSR RedBoxes and HSR QuadBoxes, as well as VLAN
compatibility.

Other improvements:
* A reduction in the number of times an skb is copied on machines without
  HAVE_EFFICIENT_UNALIGNED_ACCESS, which improves throughput somewhat.
* Headers are now created using the standard eth_header(), and using the
  standard hard_header_len.
* Each HSR slave now gets its own private skb, so slave-specific fields can be
  correctly set.
Signed-off-by: Arvid Brodin <arvid.brodin@alten.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Arvid Brodin <arvid.brodin@alten.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Arvid Brodin <arvid.brodin@alten.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Arvid Brodin <arvid.brodin@alten.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

Also try to prevent some possible slave dereference race conditions. This is
finalized in the next patch, which abandons the slave array in favour of
a list_head list and list RCU.
Signed-off-by: Arvid Brodin <arvid.brodin@alten.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Arvid Brodin <arvid.brodin@alten.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Arvid Brodin <arvid.brodin@alten.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

Also move the frame receive handler to hsr_slave.c.
Signed-off-by: Arvid Brodin <arvid.brodin@alten.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Arvid Brodin <arvid.brodin@alten.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

When the system is too busy to complete the urb, the tx timout function
would be called. This causes the other tx urbs would be killed, too.
Increase the tx timeout to avoid it.
Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

ic_dev_xid is only used in ipconfig.c

Cc: "David S. Miller" <davem@davemloft.net>
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: netdev@vger.kernel.org
Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: David S. Miller <davem@davemloft.net>

Tom Lendacky says:

====================
amd-xgbe: AMD 10Gb Ethernet driver updates

The following series fixes some bugs and provides new/changed support
in the driver.

- Fix a debugfs backward compatibility issue introduced by a previous patch
- Write to the interrupt enablement register, not the status register when
  setting MTL interrupts
- Call netif_napi_del whenever the ndo_stop operation is called (to match
  the call to netif_napi_add on ndo_open)
- Peformance enhancements:
  - Adjusted default coalescing settings
  - AXI DMA changes (burst length size and cache settings)
  - ioread/iowrite reduction during interrupt
  - Napi poll updates
- AXI DMA settings based on device tree property to account for a change in
  the ARM64 default cache operations assignment

This patch series is based on net-next.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

The default cache operations for ARM64 were changed during 3.15.
To use coherent operations a "dma-coherent" device tree property
is required.  If that property is not present in the device tree
node then the non-coherent operations are assigned for the device.

Add support to the amd-xgbe driver to assign the AXI DMA cache settings
based on whether the "dma-coherent" property is present in the device
node.  If present, use settings that work with the caches.  If not
present, use settings that do not look at the caches.
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch provides some general performance enhancements for the
driver:
  - Modify the default coalescing settings (reduce usec, increase frames)
  - Change the AXI burst length to 256 bytes (default was 16 bytes which
    was smaller than a cache line)
  - Change the AXI cache settings to write-back/write-allocate which
    allocate cache entries for received packets during the DMA since the
    packet will be processed soon afterwards
  - Combine ioread/iowrite when disabling both the Tx and Rx interrupts
  - Change to processing the Tx/Rx channels in pairs
  - Only recycle the Rx descriptors when a threshold of dirty descriptors
    is reached
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Currently the napi context is added using netif_napi_add each time
the ndo_open operation is called.  However, there is not a
corresponding netif_napi_del call during the ndo_stop operation. If
the device ndo_open operation was called more than once an infinite
loop occurs during module unload.  Add a call to netif_napi_del during
the ndo_stop operation.
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

When initializing the MTL interrupts the interrupt status
register is written to instead of the interrupt enable register.
Since no MTL interrupts are being enabled and the default state
is for MTL interrupts to be disabled this did not cause a problem,
but needs to be fixed to target the correct register.
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The initial change from sscanf to kstrtouint broke backward
compatbility by using a base of "0" in the kstrtouint call.
This allowed for entering decimal, hexadecimal or octal as
input where previously the sscanf always interpreted the input
as hexadecimal.  Additionally, -EIO was returned on error prior
to this change and now it is whatever the error value that is
returned by kstrtouint.

Change the base value of the kstrtouint from 0 to 16 and return
-EIO on error.
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Reported-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The header file include/linux/arcdevice.h #defines bool to int, if
bool is not already #defined. However, the files which use that header
file seem to rely on that #define (unconditionally) being in effect:
the prototypes for the functions arcrimi_reset, com20020_reset,
com90io_reset, com90xx_reset (whose addresses are assigned to the
hw.reset member of struct arcnet_local) use int explicitly.

Moreover, that #define is an accident waiting to happen (scenario:
inclusion of arcdevice.h followed by inclusion of some header which
declares function prototypes using bool). Also, #include
<linux/types.h> must appear before #include <linux/arcdevice.h> (the
compiler wouldn't like "typedef _Bool int").

Since none of the files using arcdevice.h declare variables of type
"bool", the patch is actually quite simple, unlike the commit message.
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>

enic_set_coalesce() has two problems.

* It should return -EINVAL and not -EOPNOTSUPP for invalid coalesce values.

* In case of MSIX, enic_set_coalesce return error after applying requested
  coalescing setting partially. We should either apply all the setting requeste
  and return success or apply non and return error.

* This patch also simplifies the algo.

This was introduced by
'7c2ce6e6 enic: Add support for adaptive interrupt coalescing'

These changes were suggested by Ben Hutchings here
http://www.spinics.net/lists/netdev/msg283972.html

Also change enic driver version.
Signed-off-by: Govindarajulu Varadarajan <_govind@gmx.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

These warnings are no longer relevant. Even when last slave is
removed, there is a valid address assigned to bond (random).
The correct functionality of vlans is ensured by maintaining unicast
list in vlan_sync_address().
Suggested-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Acked-by: Veaceslav Falico <vfalico@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Alexander Aring says:

====================
at86rf230: rework driver implementation

this patch series includes a rework of the at86rf230 driver.

There are several changes:

 - Add regmap support.
 - Merge at86rf212 operations with generic at86rf2xx operations, all chips
   supports these operations.
 - Drop of irqworker. This is a workqueue which will scheduled by an irq to
   handle synchronous spi handling. Instead using asynchronous spi handling,
   then no scheduler is involved at irq handling.
 - Also detected some bugs by receiving frame like CRC can be correct and a
   802.15.4 frame length could be above 127 bytes. This would crash the whole
   kernel (but should be handled by the mac layer). Another bug is the handling
   with RX_SAFE_MODE which protect the frame buffer after a readout. This is
   currently not working because we read out the buffer twice and the first one
   to get the frame size. Solution is to readout always the whole frame buffer.
 - Added some timing relevants things from the datasheet for state changes And
   IEEE 802.15.4 standard like interframe spacing. Interframe spacing is needed
   to insert some receiving space time between frame transmitting. This should be
   also handled by MAC layer, but it's currently a workaround to add this inside
   the driver layer.
 - Add some callback setting for chip specific handling, instead of runtime decisions
   if (is_chip_type()). Callbacks are set only once at probe time.
 - We don't using a force state change anymore. A force state change will do a
   abort of receiving frames while we want to transmit a new frame. This should
   decrease the drop rate of packets.
 - And many others changes and bug fixes...

changes since v3:
 - fix irq polarity in patch ("at86rf230: rework irq_pol setting").

changes since v2:
 - add check if necessary functions are implemented when hw flags are set in patch
   ("mac802154: at86rf230: add hw flags and merge ops"). I choosed the second variant.
 - remove unnecessary includes for workqueue and mutex in patch
   ("at86rf230: rework transmit and receive").
 - remove unnecessary cast in patch ("at86rf230: rework transmit and receive").
 - acivate regmap cache with REGCACHE_RBTREE in patch
   ("at86rf230: add regmap support").
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch removes the current synchron state change function and add a
new function for a state assert. Change the start and stop callbacks to
use this new synchron state change behaviour. It's a wrapper around the
async state change function.
Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch rework the irq_pol register setting for rising and falling
interrupt settings only. The default behaviour should be rising flag.

Also use IRQ_TYPE_* defines instead of IRQF_* defines. There is no
functionality change but irq_get_trigger_type returns IRQ_TYPE_* defines.
Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

There is no need to set this bit in start callback which could be
called more than once.
Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch is a complete reimplementation of transmit and receive
handling for the at86rf230 driver.

It solves also six bugs:

First:

The RX_SAFE_MODE is enabled and the transceiver doesn't leave the
receive state while the framebuffer isn't read by a CMD_FB command.
This is useful to read out the frame and don't get into another receive
or transmit state, otherwise the frame would be overwritten.
The current driver do twice CMD_FB calls, the first one leaves this
protection.

Second:

Sometimes the CRC calculation is correct and the length field is greater
127. The current mac802154 layer and filter of a at86rf2xx doesn't check
on this and the kernel crashes. In this case the frame is corrupted, we
send the whole receive buffer to the next layer which can be useful for
sniffing.

Thrid:
There is a undocumented race condition. When we are go into the
RX_AACK_ON state the transceiver could be changed into RX_AACK_BUSY
state. This is a normal behaviour. In this case the transceiver received
a SHR while assert wasn't finished.

Fourth:
It also handle some more "correct" state changes. In aret mode the
transceiver need to go to TX_ON before the transceiver go into
RX_AACK_ON.

Fifth:
The programming model [0] describes also a error handling in ARET mode
if the trac status is different than zero. This is patch adds support
for handling this.

Sixth:
In receive handling the transceiver should also get the trac status
according [0]. The driver could use the trac status as error statistic
handling, but the driver doesn't use this currently. There is maybe some
timing behaviour or the read of this register change some transceiver
states.

In addition the irqworker is removed. Instead we do async spi calls and
no scheduling is involved anymore. The transmit function is also
asynchron but with a wait_for_completion handling. The mac802154 layer
doesn't support asynchron transmit handling right now.

The state change behaviour is now changes, before it was:

1. assert while(!STATE_TRANSITION_IN_PROGRESS)
2. state change
3. assert while(!STATE_TRANSITION_IN_PROGRESS)
4. assert once(wanted state != current state)

Sometimes a unexcepted state change occurs when 4. assert was violated.
The new state change behaviour is:

1. assert while(!STATE_TRANSITION_IN_PROGRESS)
2. state change
3. wait state change timing according datasheet
4. assert once(wanted state != current state)

This behaviour is described in the at86rf231 software programming model [0].
The state change documentation in this programming guide should also valid for
at86rf212 and at86rf233 chips.

The transceiver don't do a FORCE_TX_ON while we want to transmit a PDU.
The new behaviour is a TX_ON and wait a receiving time (tFrame + tPAck).
If we are still in RX_AACK_BUSY then we transmit a FORCE_TX_ON as timeout
handling. The different is that FORCE_TX_ON aborts receiving and TX_ON
waits if RX_AACK_BUSY is finished. This should decrease the drop rate of
packets.

[0] http://www.atmel.com/Images/AVR2022_swpm231-2.0.zipSigned-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>