Merge branch 'linus' into x86/xen

14 files changed, 316 insertions, 136 deletions

diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 869544b8c05c..9c0f56b3c518 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4067,8 +4067,6 @@ static void e1000_netpoll(struct net_device *netdev)
         disable_irq(adapter->pdev->irq);
         e1000_intr(adapter->pdev->irq, netdev);
 
-        e1000_clean_tx_irq(adapter);
-
         enable_irq(adapter->pdev->irq);
 }
 #endif
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 32a4f17d35fc..ecd5c71a7a8a 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -2,12 +2,6 @@
  * Fast Ethernet Controller (FEC) driver for Motorola MPC8xx.
  * Copyright (c) 1997 Dan Malek (dmalek@jlc.net)
  *
- * This version of the driver is specific to the FADS implementation,
- * since the board contains control registers external to the processor
- * for the control of the LevelOne LXT970 transceiver.  The MPC860T manual
- * describes connections using the internal parallel port I/O, which
- * is basically all of Port D.
- *
  * Right now, I am very wasteful with the buffers.  I allocate memory
  * pages and then divide them into 2K frame buffers.  This way I know I
  * have buffers large enough to hold one frame within one buffer descriptor.
@@ -49,17 +43,9 @@
 #include <asm/pgtable.h>
 #include <asm/cacheflush.h>
 
-#if defined(CONFIG_M523x) || defined(CONFIG_M527x) || \
-    defined(CONFIG_M5272) || defined(CONFIG_M528x) || \
-    defined(CONFIG_M520x) || defined(CONFIG_M532x)
 #include <asm/coldfire.h>
 #include <asm/mcfsim.h>
 #include "fec.h"
-#else
-#include <asm/8xx_immap.h>
-#include <asm/mpc8xx.h>
-#include "commproc.h"
-#endif
 
 #if defined(CONFIG_FEC2)
 #define FEC_MAX_PORTS   2
@@ -67,7 +53,7 @@
 #define FEC_MAX_PORTS   1
 #endif
 
-#if defined(CONFIG_FADS) || defined(CONFIG_RPXCLASSIC) || defined(CONFIG_M5272)
+#if defined(CONFIG_M5272)
 #define HAVE_mii_link_interrupt
 #endif
 
@@ -1235,14 +1221,9 @@ static phy_info_t const * const phy_info[] = {
 
 /* ------------------------------------------------------------------------- */
 #ifdef HAVE_mii_link_interrupt
-#ifdef CONFIG_RPXCLASSIC
-static void
-mii_link_interrupt(void *dev_id);
-#else
 static irqreturn_t
 mii_link_interrupt(int irq, void * dev_id);
 #endif
-#endif
 
 #if defined(CONFIG_M5272)
 /*
@@ -1795,24 +1776,6 @@ static void __inline__ fec_request_intrs(struct net_device *dev)
 
         if (request_8xxirq(FEC_INTERRUPT, fec_enet_interrupt, 0, "fec", dev) != 0)
                 panic("Could not allocate FEC IRQ!");
-
-#ifdef CONFIG_RPXCLASSIC
-        /* Make Port C, bit 15 an input that causes interrupts.
-        */
-        immap->im_ioport.iop_pcpar &= ~0x0001;
-        immap->im_ioport.iop_pcdir &= ~0x0001;
-        immap->im_ioport.iop_pcso &= ~0x0001;
-        immap->im_ioport.iop_pcint |= 0x0001;
-        cpm_install_handler(CPMVEC_PIO_PC15, mii_link_interrupt, dev);
-
-        /* Make LEDS reflect Link status.
-        */
-        *((uint *) RPX_CSR_ADDR) &= ~BCSR2_FETHLEDMODE;
-#endif
-#ifdef CONFIG_FADS
-        if (request_8xxirq(SIU_IRQ2, mii_link_interrupt, 0, "mii", dev) != 0)
-                panic("Could not allocate MII IRQ!");
-#endif
 }
 
 static void __inline__ fec_get_mac(struct net_device *dev)
@@ -1821,16 +1784,6 @@ static void __inline__ fec_get_mac(struct net_device *dev)
 
         bd = (bd_t *)__res;
         memcpy(dev->dev_addr, bd->bi_enetaddr, ETH_ALEN);
-
-#ifdef CONFIG_RPXCLASSIC
-        /* The Embedded Planet boards have only one MAC address in
-         * the EEPROM, but can have two Ethernet ports.  For the
-         * FEC port, we create another address by setting one of
-         * the address bits above something that would have (up to
-         * now) been allocated.
-         */
-        dev->dev_adrd[3] |= 0x80;
-#endif
 }
 
 static void __inline__ fec_set_mii(struct net_device *dev, struct fec_enet_private *fep)
@@ -2109,13 +2062,8 @@ mii_discover_phy(uint mii_reg, struct net_device *dev)
 /* This interrupt occurs when the PHY detects a link change.
 */
 #ifdef HAVE_mii_link_interrupt
-#ifdef CONFIG_RPXCLASSIC
-static void
-mii_link_interrupt(void *dev_id)
-#else
 static irqreturn_t
 mii_link_interrupt(int irq, void * dev_id)
-#endif
 {
         struct  net_device *dev = dev_id;
         struct fec_enet_private *fep = netdev_priv(dev);
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index 00527805e4f1..e5a6e2e84540 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -33,6 +33,7 @@
 */
 
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/ioport.h>
@@ -52,7 +53,9 @@
 #include <asm/hvcall.h>
 #include <asm/atomic.h>
 #include <asm/vio.h>
+#include <asm/iommu.h>
 #include <asm/uaccess.h>
+#include <asm/firmware.h>
 #include <linux/seq_file.h>
 
 #include "ibmveth.h"
@@ -94,8 +97,10 @@ static void ibmveth_proc_register_adapter(struct ibmveth_adapter *adapter);
 static void ibmveth_proc_unregister_adapter(struct ibmveth_adapter *adapter);
 static irqreturn_t ibmveth_interrupt(int irq, void *dev_instance);
 static void ibmveth_rxq_harvest_buffer(struct ibmveth_adapter *adapter);
+static unsigned long ibmveth_get_desired_dma(struct vio_dev *vdev);
 static struct kobj_type ktype_veth_pool;
 
+
 #ifdef CONFIG_PROC_FS
 #define IBMVETH_PROC_DIR "ibmveth"
 static struct proc_dir_entry *ibmveth_proc_dir;
@@ -226,16 +231,16 @@ static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struc
         u32 i;
         u32 count = pool->size - atomic_read(&pool->available);
         u32 buffers_added = 0;
+        struct sk_buff *skb;
+        unsigned int free_index, index;
+        u64 correlator;
+        unsigned long lpar_rc;
+        dma_addr_t dma_addr;
 
         mb();
 
         for(i = 0; i < count; ++i) {
-                struct sk_buff *skb;
-                unsigned int free_index, index;
-                u64 correlator;
                 union ibmveth_buf_desc desc;
-                unsigned long lpar_rc;
-                dma_addr_t dma_addr;
 
                 skb = alloc_skb(pool->buff_size, GFP_ATOMIC);
 
@@ -255,6 +260,9 @@ static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struc
                 dma_addr = dma_map_single(&adapter->vdev->dev, skb->data,
                                 pool->buff_size, DMA_FROM_DEVICE);
 
+                if (dma_mapping_error(dma_addr))
+                        goto failure;
+
                 pool->free_map[free_index] = IBM_VETH_INVALID_MAP;
                 pool->dma_addr[index] = dma_addr;
                 pool->skbuff[index] = skb;
@@ -267,20 +275,9 @@ static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struc
 
                 lpar_rc = h_add_logical_lan_buffer(adapter->vdev->unit_address, desc.desc);
 
-                if(lpar_rc != H_SUCCESS) {
-                        pool->free_map[free_index] = index;
-                        pool->skbuff[index] = NULL;
-                        if (pool->consumer_index == 0)
-                                pool->consumer_index = pool->size - 1;
-                        else
-                                pool->consumer_index--;
-                        dma_unmap_single(&adapter->vdev->dev,
-                                        pool->dma_addr[index], pool->buff_size,
-                                        DMA_FROM_DEVICE);
-                        dev_kfree_skb_any(skb);
-                        adapter->replenish_add_buff_failure++;
-                        break;
-                } else {
+                if (lpar_rc != H_SUCCESS)
+                        goto failure;
+                else {
                         buffers_added++;
                         adapter->replenish_add_buff_success++;
                 }
@@ -288,6 +285,24 @@ static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struc
 
         mb();
         atomic_add(buffers_added, &(pool->available));
+        return;
+
+failure:
+        pool->free_map[free_index] = index;
+        pool->skbuff[index] = NULL;
+        if (pool->consumer_index == 0)
+                pool->consumer_index = pool->size - 1;
+        else
+                pool->consumer_index--;
+        if (!dma_mapping_error(dma_addr))
+                dma_unmap_single(&adapter->vdev->dev,
+                                 pool->dma_addr[index], pool->buff_size,
+                                 DMA_FROM_DEVICE);
+        dev_kfree_skb_any(skb);
+        adapter->replenish_add_buff_failure++;
+
+        mb();
+        atomic_add(buffers_added, &(pool->available));
 }
 
 /* replenish routine */
@@ -297,7 +312,7 @@ static void ibmveth_replenish_task(struct ibmveth_adapter *adapter)
 
         adapter->replenish_task_cycles++;
 
-        for(i = 0; i < IbmVethNumBufferPools; i++)
+        for (i = (IbmVethNumBufferPools - 1); i >= 0; i--)
                 if(adapter->rx_buff_pool[i].active)
                         ibmveth_replenish_buffer_pool(adapter,
                                                      &adapter->rx_buff_pool[i]);
@@ -472,6 +487,18 @@ static void ibmveth_cleanup(struct ibmveth_adapter *adapter)
                 if (adapter->rx_buff_pool[i].active)
                         ibmveth_free_buffer_pool(adapter,
                                                  &adapter->rx_buff_pool[i]);
+
+        if (adapter->bounce_buffer != NULL) {
+                if (!dma_mapping_error(adapter->bounce_buffer_dma)) {
+                        dma_unmap_single(&adapter->vdev->dev,
+                                        adapter->bounce_buffer_dma,
+                                        adapter->netdev->mtu + IBMVETH_BUFF_OH,
+                                        DMA_BIDIRECTIONAL);
+                        adapter->bounce_buffer_dma = DMA_ERROR_CODE;
+                }
+                kfree(adapter->bounce_buffer);
+                adapter->bounce_buffer = NULL;
+        }
 }
 
 static int ibmveth_register_logical_lan(struct ibmveth_adapter *adapter,
@@ -607,6 +634,24 @@ static int ibmveth_open(struct net_device *netdev)
                 return rc;
         }
 
+        adapter->bounce_buffer =
+            kmalloc(netdev->mtu + IBMVETH_BUFF_OH, GFP_KERNEL);
+        if (!adapter->bounce_buffer) {
+                ibmveth_error_printk("unable to allocate bounce buffer\n");
+                ibmveth_cleanup(adapter);
+                napi_disable(&adapter->napi);
+                return -ENOMEM;
+        }
+        adapter->bounce_buffer_dma =
+            dma_map_single(&adapter->vdev->dev, adapter->bounce_buffer,
+                           netdev->mtu + IBMVETH_BUFF_OH, DMA_BIDIRECTIONAL);
+        if (dma_mapping_error(adapter->bounce_buffer_dma)) {
+                ibmveth_error_printk("unable to map bounce buffer\n");
+                ibmveth_cleanup(adapter);
+                napi_disable(&adapter->napi);
+                return -ENOMEM;
+        }
+
         ibmveth_debug_printk("initial replenish cycle\n");
         ibmveth_interrupt(netdev->irq, netdev);
 
@@ -853,10 +898,12 @@ static int ibmveth_start_xmit(struct sk_buff *skb, struct net_device *netdev)
         unsigned int tx_packets = 0;
         unsigned int tx_send_failed = 0;
         unsigned int tx_map_failed = 0;
+        int used_bounce = 0;
+        unsigned long data_dma_addr;
 
         desc.fields.flags_len = IBMVETH_BUF_VALID | skb->len;
-        desc.fields.address = dma_map_single(&adapter->vdev->dev, skb->data,
-                                             skb->len, DMA_TO_DEVICE);
+        data_dma_addr = dma_map_single(&adapter->vdev->dev, skb->data,
+                                       skb->len, DMA_TO_DEVICE);
 
         if (skb->ip_summed == CHECKSUM_PARTIAL &&
             ip_hdr(skb)->protocol != IPPROTO_TCP && skb_checksum_help(skb)) {
@@ -875,12 +922,16 @@ static int ibmveth_start_xmit(struct sk_buff *skb, struct net_device *netdev)
                 buf[1] = 0;
         }
 
-        if (dma_mapping_error(desc.fields.address)) {
-                ibmveth_error_printk("tx: unable to map xmit buffer\n");
+        if (dma_mapping_error(data_dma_addr)) {
+                if (!firmware_has_feature(FW_FEATURE_CMO))
+                        ibmveth_error_printk("tx: unable to map xmit buffer\n");
+                skb_copy_from_linear_data(skb, adapter->bounce_buffer,
+                                          skb->len);
+                desc.fields.address = adapter->bounce_buffer_dma;
                 tx_map_failed++;
-                tx_dropped++;
-                goto out;
-        }
+                used_bounce = 1;
+        } else
+                desc.fields.address = data_dma_addr;
 
         /* send the frame. Arbitrarily set retrycount to 1024 */
         correlator = 0;
@@ -904,8 +955,9 @@ static int ibmveth_start_xmit(struct sk_buff *skb, struct net_device *netdev)
                 netdev->trans_start = jiffies;
         }
 
-        dma_unmap_single(&adapter->vdev->dev, desc.fields.address,
-                         skb->len, DMA_TO_DEVICE);
+        if (!used_bounce)
+                dma_unmap_single(&adapter->vdev->dev, data_dma_addr,
+                                 skb->len, DMA_TO_DEVICE);
 
 out:    spin_lock_irqsave(&adapter->stats_lock, flags);
         netdev->stats.tx_dropped += tx_dropped;
@@ -1053,9 +1105,9 @@ static void ibmveth_set_multicast_list(struct net_device *netdev)
 static int ibmveth_change_mtu(struct net_device *dev, int new_mtu)
 {
         struct ibmveth_adapter *adapter = dev->priv;
+        struct vio_dev *viodev = adapter->vdev;
         int new_mtu_oh = new_mtu + IBMVETH_BUFF_OH;
-        int reinit = 0;
-        int i, rc;
+        int i;
 
         if (new_mtu < IBMVETH_MAX_MTU)
                 return -EINVAL;
@@ -1067,23 +1119,34 @@ static int ibmveth_change_mtu(struct net_device *dev, int new_mtu)
         if (i == IbmVethNumBufferPools)
                 return -EINVAL;
 
+        /* Deactivate all the buffer pools so that the next loop can activate
+           only the buffer pools necessary to hold the new MTU */
+        for (i = 0; i < IbmVethNumBufferPools; i++)
+                if (adapter->rx_buff_pool[i].active) {
+                        ibmveth_free_buffer_pool(adapter,
+                                                 &adapter->rx_buff_pool[i]);
+                        adapter->rx_buff_pool[i].active = 0;
+                }
+
         /* Look for an active buffer pool that can hold the new MTU */
         for(i = 0; i<IbmVethNumBufferPools; i++) {
-                if (!adapter->rx_buff_pool[i].active) {
-                        adapter->rx_buff_pool[i].active = 1;
-                        reinit = 1;
-                }
+                adapter->rx_buff_pool[i].active = 1;
 
                 if (new_mtu_oh < adapter->rx_buff_pool[i].buff_size) {
-                        if (reinit && netif_running(adapter->netdev)) {
+                        if (netif_running(adapter->netdev)) {
                                 adapter->pool_config = 1;
                                 ibmveth_close(adapter->netdev);
                                 adapter->pool_config = 0;
                                 dev->mtu = new_mtu;
-                                if ((rc = ibmveth_open(adapter->netdev)))
-                                        return rc;
-                        } else
-                                dev->mtu = new_mtu;
+                                vio_cmo_set_dev_desired(viodev,
+                                                ibmveth_get_desired_dma
+                                                (viodev));
+                                return ibmveth_open(adapter->netdev);
+                        }
+                        dev->mtu = new_mtu;
+                        vio_cmo_set_dev_desired(viodev,
+                                                ibmveth_get_desired_dma
+                                                (viodev));
                         return 0;
                 }
         }
@@ -1098,6 +1161,46 @@ static void ibmveth_poll_controller(struct net_device *dev)
 }
 #endif
 
+/**
+ * ibmveth_get_desired_dma - Calculate IO memory desired by the driver
+ *
+ * @vdev: struct vio_dev for the device whose desired IO mem is to be returned
+ *
+ * Return value:
+ *      Number of bytes of IO data the driver will need to perform well.
+ */
+static unsigned long ibmveth_get_desired_dma(struct vio_dev *vdev)
+{
+        struct net_device *netdev = dev_get_drvdata(&vdev->dev);
+        struct ibmveth_adapter *adapter;
+        unsigned long ret;
+        int i;
+        int rxqentries = 1;
+
+        /* netdev inits at probe time along with the structures we need below*/
+        if (netdev == NULL)
+                return IOMMU_PAGE_ALIGN(IBMVETH_IO_ENTITLEMENT_DEFAULT);
+
+        adapter = netdev_priv(netdev);
+
+        ret = IBMVETH_BUFF_LIST_SIZE + IBMVETH_FILT_LIST_SIZE;
+        ret += IOMMU_PAGE_ALIGN(netdev->mtu);
+
+        for (i = 0; i < IbmVethNumBufferPools; i++) {
+                /* add the size of the active receive buffers */
+                if (adapter->rx_buff_pool[i].active)
+                        ret +=
+                            adapter->rx_buff_pool[i].size *
+                            IOMMU_PAGE_ALIGN(adapter->rx_buff_pool[i].
+                                    buff_size);
+                rxqentries += adapter->rx_buff_pool[i].size;
+        }
+        /* add the size of the receive queue entries */
+        ret += IOMMU_PAGE_ALIGN(rxqentries * sizeof(struct ibmveth_rx_q_entry));
+
+        return ret;
+}
+
 static int __devinit ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
 {
         int rc, i;
@@ -1242,6 +1345,8 @@ static int __devexit ibmveth_remove(struct vio_dev *dev)
         ibmveth_proc_unregister_adapter(adapter);
 
         free_netdev(netdev);
+        dev_set_drvdata(&dev->dev, NULL);
+
         return 0;
 }
 
@@ -1402,14 +1507,15 @@ const char * buf, size_t count)
                                 return -EPERM;
                         }
 
-                        pool->active = 0;
                         if (netif_running(netdev)) {
                                 adapter->pool_config = 1;
                                 ibmveth_close(netdev);
+                                pool->active = 0;
                                 adapter->pool_config = 0;
                                 if ((rc = ibmveth_open(netdev)))
                                         return rc;
                         }
+                        pool->active = 0;
                 }
         } else if (attr == &veth_num_attr) {
                 if (value <= 0 || value > IBMVETH_MAX_POOL_COUNT)
@@ -1485,6 +1591,7 @@ static struct vio_driver ibmveth_driver = {
         .id_table       = ibmveth_device_table,
         .probe          = ibmveth_probe,
         .remove         = ibmveth_remove,
+        .get_desired_dma = ibmveth_get_desired_dma,
         .driver         = {
                 .name   = ibmveth_driver_name,
                 .owner  = THIS_MODULE,
diff --git a/drivers/net/ibmveth.h b/drivers/net/ibmveth.h
index 41f61cd18852..d28186948752 100644
--- a/drivers/net/ibmveth.h
+++ b/drivers/net/ibmveth.h
@@ -93,9 +93,12 @@ static inline long h_illan_attributes(unsigned long unit_address,
   plpar_hcall_norets(H_CHANGE_LOGICAL_LAN_MAC, ua, mac)
 
 #define IbmVethNumBufferPools 5
+#define IBMVETH_IO_ENTITLEMENT_DEFAULT 4243456 /* MTU of 1500 needs 4.2Mb */
 #define IBMVETH_BUFF_OH 22 /* Overhead: 14 ethernet header + 8 opaque handle */
 #define IBMVETH_MAX_MTU 68
 #define IBMVETH_MAX_POOL_COUNT 4096
+#define IBMVETH_BUFF_LIST_SIZE 4096
+#define IBMVETH_FILT_LIST_SIZE 4096
 #define IBMVETH_MAX_BUF_SIZE (1024 * 128)
 
 static int pool_size[] = { 512, 1024 * 2, 1024 * 16, 1024 * 32, 1024 * 64 };
@@ -143,6 +146,8 @@ struct ibmveth_adapter {
     struct ibmveth_rx_q rx_queue;
     int pool_config;
     int rx_csum;
+    void *bounce_buffer;
+    dma_addr_t bounce_buffer_dma;
 
     /* adapter specific stats */
     u64 replenish_task_cycles;
diff --git a/drivers/net/mlx4/cmd.c b/drivers/net/mlx4/cmd.c
index 70dff94a8bc6..04d5bc69a6f8 100644
--- a/drivers/net/mlx4/cmd.c
+++ b/drivers/net/mlx4/cmd.c
@@ -67,6 +67,8 @@ enum {
         CMD_STAT_BAD_INDEX      = 0x0a,
         /* FW image corrupted: */
         CMD_STAT_BAD_NVMEM      = 0x0b,
+        /* Error in ICM mapping (e.g. not enough auxiliary ICM pages to execute command): */
+        CMD_STAT_ICM_ERROR      = 0x0c,
         /* Attempt to modify a QP/EE which is not in the presumed state: */
         CMD_STAT_BAD_QP_STATE   = 0x10,
         /* Bad segment parameters (Address/Size): */
@@ -119,6 +121,7 @@ static int mlx4_status_to_errno(u8 status)
                 [CMD_STAT_BAD_RES_STATE]  = -EBADF,
                 [CMD_STAT_BAD_INDEX]      = -EBADF,
                 [CMD_STAT_BAD_NVMEM]      = -EFAULT,
+                [CMD_STAT_ICM_ERROR]      = -ENFILE,
                 [CMD_STAT_BAD_QP_STATE]   = -EINVAL,
                 [CMD_STAT_BAD_SEG_PARAM]  = -EFAULT,
                 [CMD_STAT_REG_BOUND]      = -EBUSY,
diff --git a/drivers/net/mlx4/eq.c b/drivers/net/mlx4/eq.c
index e141a1513f07..ea3a09aaa844 100644
--- a/drivers/net/mlx4/eq.c
+++ b/drivers/net/mlx4/eq.c
@@ -33,6 +33,7 @@
 
 #include <linux/init.h>
 #include <linux/interrupt.h>
+#include <linux/mm.h>
 #include <linux/dma-mapping.h>
 
 #include <linux/mlx4/cmd.h>
diff --git a/drivers/net/mlx4/fw.c b/drivers/net/mlx4/fw.c
index 2b5006b9be67..57278224ba1e 100644
--- a/drivers/net/mlx4/fw.c
+++ b/drivers/net/mlx4/fw.c
@@ -46,6 +46,10 @@ enum {
 extern void __buggy_use_of_MLX4_GET(void);
 extern void __buggy_use_of_MLX4_PUT(void);
 
+static int enable_qos;
+module_param(enable_qos, bool, 0444);
+MODULE_PARM_DESC(enable_qos, "Enable Quality of Service support in the HCA (default: off)");
+
 #define MLX4_GET(dest, source, offset)                                \
         do {                                                          \
                 void *__p = (char *) (source) + (offset);             \
@@ -198,7 +202,7 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
 #define QUERY_DEV_CAP_C_MPT_ENTRY_SZ_OFFSET     0x8e
 #define QUERY_DEV_CAP_MTT_ENTRY_SZ_OFFSET       0x90
 #define QUERY_DEV_CAP_D_MPT_ENTRY_SZ_OFFSET     0x92
-#define QUERY_DEV_CAP_BMME_FLAGS_OFFSET         0x97
+#define QUERY_DEV_CAP_BMME_FLAGS_OFFSET         0x94
 #define QUERY_DEV_CAP_RSVD_LKEY_OFFSET          0x98
 #define QUERY_DEV_CAP_MAX_ICM_SZ_OFFSET         0xa0
 
@@ -373,12 +377,8 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
                 }
         }
 
-        if (dev_cap->bmme_flags & 1)
-                mlx4_dbg(dev, "Base MM extensions: yes "
-                         "(flags %d, rsvd L_Key %08x)\n",
-                         dev_cap->bmme_flags, dev_cap->reserved_lkey);
-        else
-                mlx4_dbg(dev, "Base MM extensions: no\n");
+        mlx4_dbg(dev, "Base MM extensions: flags %08x, rsvd L_Key %08x\n",
+                 dev_cap->bmme_flags, dev_cap->reserved_lkey);
 
         /*
          * Each UAR has 4 EQ doorbells; so if a UAR is reserved, then
@@ -737,6 +737,10 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev, struct mlx4_init_hca_param *param)
         if (dev->caps.flags & MLX4_DEV_CAP_FLAG_IPOIB_CSUM)
                 *(inbox + INIT_HCA_FLAGS_OFFSET / 4) |= cpu_to_be32(1 << 3);
 
+        /* Enable QoS support if module parameter set */
+        if (enable_qos)
+                *(inbox + INIT_HCA_FLAGS_OFFSET / 4) |= cpu_to_be32(1 << 2);
+
         /* QPC/EEC/CQC/EQC/RDMARC attributes */
 
         MLX4_PUT(inbox, param->qpc_base,      INIT_HCA_QPC_BASE_OFFSET);
diff --git a/drivers/net/mlx4/fw.h b/drivers/net/mlx4/fw.h
index a0e046c149b7..fbf0e22be122 100644
--- a/drivers/net/mlx4/fw.h
+++ b/drivers/net/mlx4/fw.h
@@ -98,7 +98,7 @@ struct mlx4_dev_cap {
         int cmpt_entry_sz;
         int mtt_entry_sz;
         int resize_srq;
-        u8  bmme_flags;
+        u32 bmme_flags;
         u32 reserved_lkey;
         u64 max_icm_sz;
         int max_gso_sz;
diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
index d3736013fe9b..8e1d24cda1b0 100644
--- a/drivers/net/mlx4/main.c
+++ b/drivers/net/mlx4/main.c
@@ -158,6 +158,8 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
         dev->caps.max_msg_sz         = dev_cap->max_msg_sz;
         dev->caps.page_size_cap      = ~(u32) (dev_cap->min_page_sz - 1);
         dev->caps.flags              = dev_cap->flags;
+        dev->caps.bmme_flags         = dev_cap->bmme_flags;
+        dev->caps.reserved_lkey      = dev_cap->reserved_lkey;
         dev->caps.stat_rate_support  = dev_cap->stat_rate_support;
         dev->caps.max_gso_sz         = dev_cap->max_gso_sz;
 
diff --git a/drivers/net/mlx4/mlx4.h b/drivers/net/mlx4/mlx4.h
index a4023c2dd050..78038499cff5 100644
--- a/drivers/net/mlx4/mlx4.h
+++ b/drivers/net/mlx4/mlx4.h
@@ -118,6 +118,7 @@ struct mlx4_bitmap {
 
 struct mlx4_buddy {
         unsigned long         **bits;
+        unsigned int           *num_free;
         int                     max_order;
         spinlock_t              lock;
 };
diff --git a/drivers/net/mlx4/mr.c b/drivers/net/mlx4/mr.c
index 03a9abcce524..a3c04c5f12c2 100644
--- a/drivers/net/mlx4/mr.c
+++ b/drivers/net/mlx4/mr.c
@@ -47,7 +47,7 @@ struct mlx4_mpt_entry {
         __be32 flags;
         __be32 qpn;
         __be32 key;
-        __be32 pd;
+        __be32 pd_flags;
         __be64 start;
         __be64 length;
         __be32 lkey;
@@ -61,11 +61,15 @@ struct mlx4_mpt_entry {
 } __attribute__((packed));
 
 #define MLX4_MPT_FLAG_SW_OWNS       (0xfUL << 28)
+#define MLX4_MPT_FLAG_FREE          (0x3UL << 28)
 #define MLX4_MPT_FLAG_MIO           (1 << 17)
 #define MLX4_MPT_FLAG_BIND_ENABLE   (1 << 15)
 #define MLX4_MPT_FLAG_PHYSICAL      (1 <<  9)
 #define MLX4_MPT_FLAG_REGION        (1 <<  8)
 
+#define MLX4_MPT_PD_FLAG_FAST_REG   (1 << 26)
+#define MLX4_MPT_PD_FLAG_EN_INV     (3 << 24)
+
 #define MLX4_MTT_FLAG_PRESENT           1
 
 #define MLX4_MPT_STATUS_SW              0xF0
@@ -79,23 +83,26 @@ static u32 mlx4_buddy_alloc(struct mlx4_buddy *buddy, int order)
 
         spin_lock(&buddy->lock);
 
-        for (o = order; o <= buddy->max_order; ++o) {
-                m = 1 << (buddy->max_order - o);
-                seg = find_first_bit(buddy->bits[o], m);
-                if (seg < m)
-                        goto found;
-        }
+        for (o = order; o <= buddy->max_order; ++o)
+                if (buddy->num_free[o]) {
+                        m = 1 << (buddy->max_order - o);
+                        seg = find_first_bit(buddy->bits[o], m);
+                        if (seg < m)
+                                goto found;
+                }
 
         spin_unlock(&buddy->lock);
         return -1;
 
  found:
         clear_bit(seg, buddy->bits[o]);
+        --buddy->num_free[o];
 
         while (o > order) {
                 --o;
                 seg <<= 1;
                 set_bit(seg ^ 1, buddy->bits[o]);
+                ++buddy->num_free[o];
         }
 
         spin_unlock(&buddy->lock);
@@ -113,11 +120,13 @@ static void mlx4_buddy_free(struct mlx4_buddy *buddy, u32 seg, int order)
 
         while (test_bit(seg ^ 1, buddy->bits[order])) {
                 clear_bit(seg ^ 1, buddy->bits[order]);
+                --buddy->num_free[order];
                 seg >>= 1;
                 ++order;
         }
 
         set_bit(seg, buddy->bits[order]);
+        ++buddy->num_free[order];
 
         spin_unlock(&buddy->lock);
 }
@@ -131,7 +140,9 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order)
 
         buddy->bits = kzalloc((buddy->max_order + 1) * sizeof (long *),
                               GFP_KERNEL);
-        if (!buddy->bits)
+        buddy->num_free = kzalloc((buddy->max_order + 1) * sizeof (int *),
+                                  GFP_KERNEL);
+        if (!buddy->bits || !buddy->num_free)
                 goto err_out;
 
         for (i = 0; i <= buddy->max_order; ++i) {
@@ -143,6 +154,7 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order)
         }
 
         set_bit(0, buddy->bits[buddy->max_order]);
+        buddy->num_free[buddy->max_order] = 1;
 
         return 0;
 
@@ -150,9 +162,10 @@ err_out_free:
         for (i = 0; i <= buddy->max_order; ++i)
                 kfree(buddy->bits[i]);
 
+err_out:
         kfree(buddy->bits);
+        kfree(buddy->num_free);
 
-err_out:
         return -ENOMEM;
 }
 
@@ -164,6 +177,7 @@ static void mlx4_buddy_cleanup(struct mlx4_buddy *buddy)
                 kfree(buddy->bits[i]);
 
         kfree(buddy->bits);
+        kfree(buddy->num_free);
 }
 
 static u32 mlx4_alloc_mtt_range(struct mlx4_dev *dev, int order)
@@ -314,21 +328,30 @@ int mlx4_mr_enable(struct mlx4_dev *dev, struct mlx4_mr *mr)
 
         memset(mpt_entry, 0, sizeof *mpt_entry);
 
-        mpt_entry->flags = cpu_to_be32(MLX4_MPT_FLAG_SW_OWNS     |
-                                       MLX4_MPT_FLAG_MIO         |
+        mpt_entry->flags = cpu_to_be32(MLX4_MPT_FLAG_MIO         |
                                        MLX4_MPT_FLAG_REGION      |
                                        mr->access);
 
         mpt_entry->key         = cpu_to_be32(key_to_hw_index(mr->key));
-        mpt_entry->pd          = cpu_to_be32(mr->pd);
+        mpt_entry->pd_flags    = cpu_to_be32(mr->pd | MLX4_MPT_PD_FLAG_EN_INV);
         mpt_entry->start       = cpu_to_be64(mr->iova);
         mpt_entry->length      = cpu_to_be64(mr->size);
         mpt_entry->entity_size = cpu_to_be32(mr->mtt.page_shift);
+
         if (mr->mtt.order < 0) {
                 mpt_entry->flags |= cpu_to_be32(MLX4_MPT_FLAG_PHYSICAL);
                 mpt_entry->mtt_seg = 0;
-        } else
+        } else {
                 mpt_entry->mtt_seg = cpu_to_be64(mlx4_mtt_addr(dev, &mr->mtt));
+        }
+
+        if (mr->mtt.order >= 0 && mr->mtt.page_shift == 0) {
+                /* fast register MR in free state */
+                mpt_entry->flags    |= cpu_to_be32(MLX4_MPT_FLAG_FREE);
+                mpt_entry->pd_flags |= cpu_to_be32(MLX4_MPT_PD_FLAG_FAST_REG);
+        } else {
+                mpt_entry->flags    |= cpu_to_be32(MLX4_MPT_FLAG_SW_OWNS);
+        }
 
         err = mlx4_SW2HW_MPT(dev, mailbox,
                              key_to_hw_index(mr->key) & (dev->caps.num_mpts - 1));
diff --git a/drivers/net/mlx4/pd.c b/drivers/net/mlx4/pd.c
index 3a93c5f0f7ab..aa616892d09c 100644
--- a/drivers/net/mlx4/pd.c
+++ b/drivers/net/mlx4/pd.c
@@ -91,6 +91,13 @@ EXPORT_SYMBOL_GPL(mlx4_uar_free);
 
 int mlx4_init_uar_table(struct mlx4_dev *dev)
 {
+        if (dev->caps.num_uars <= 128) {
+                mlx4_err(dev, "Only %d UAR pages (need more than 128)\n",
+                         dev->caps.num_uars);
+                mlx4_err(dev, "Increase firmware log2_uar_bar_megabytes?\n");
+                return -ENODEV;
+        }
+
         return mlx4_bitmap_init(&mlx4_priv(dev)->uar_table.bitmap,
                                 dev->caps.num_uars, dev->caps.num_uars - 1,
                                 max(128, dev->caps.reserved_uars));
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 711e4a8948e0..5257cf464f1a 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1829,9 +1829,6 @@ static int sky2_down(struct net_device *dev)
         if (netif_msg_ifdown(sky2))
                 printk(KERN_INFO PFX "%s: disabling interface\n", dev->name);
 
-        /* Stop more packets from being queued */
-        netif_stop_queue(dev);
-
         /* Disable port IRQ */
         imask = sky2_read32(hw, B0_IMSK);
         imask &= ~portirq_msk[port];
@@ -1887,8 +1884,6 @@ static int sky2_down(struct net_device *dev)
 
         sky2_phy_power_down(hw, port);
 
-        netif_carrier_off(dev);
-
         /* turn off LED's */
         sky2_write16(hw, B0_Y2LED, LED_STAT_OFF);
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index c28d7cb2035b..0196a0df9021 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -19,6 +19,7 @@
 //#define DEBUG
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/ethtool.h>
 #include <linux/module.h>
 #include <linux/virtio.h>
 #include <linux/virtio_net.h>
@@ -54,9 +55,15 @@ struct virtnet_info
         struct tasklet_struct tasklet;
         bool free_in_tasklet;
 
+        /* I like... big packets and I cannot lie! */
+        bool big_packets;
+
         /* Receive & send queues. */
         struct sk_buff_head recv;
         struct sk_buff_head send;
+
+        /* Chain pages by the private ptr. */
+        struct page *pages;
 };
 
 static inline struct virtio_net_hdr *skb_vnet_hdr(struct sk_buff *skb)
@@ -69,6 +76,23 @@ static inline void vnet_hdr_to_sg(struct scatterlist *sg, struct sk_buff *skb)
         sg_init_one(sg, skb_vnet_hdr(skb), sizeof(struct virtio_net_hdr));
 }
 
+static void give_a_page(struct virtnet_info *vi, struct page *page)
+{
+        page->private = (unsigned long)vi->pages;
+        vi->pages = page;
+}
+
+static struct page *get_a_page(struct virtnet_info *vi, gfp_t gfp_mask)
+{
+        struct page *p = vi->pages;
+
+        if (p)
+                vi->pages = (struct page *)p->private;
+        else
+                p = alloc_page(gfp_mask);
+        return p;
+}
+
 static void skb_xmit_done(struct virtqueue *svq)
 {
         struct virtnet_info *vi = svq->vdev->priv;
@@ -88,6 +112,7 @@ static void receive_skb(struct net_device *dev, struct sk_buff *skb,
                         unsigned len)
 {
         struct virtio_net_hdr *hdr = skb_vnet_hdr(skb);
+        int err;
 
         if (unlikely(len < sizeof(struct virtio_net_hdr) + ETH_HLEN)) {
                 pr_debug("%s: short packet %i\n", dev->name, len);
@@ -95,10 +120,23 @@ static void receive_skb(struct net_device *dev, struct sk_buff *skb,
                 goto drop;
         }
         len -= sizeof(struct virtio_net_hdr);
-        BUG_ON(len > MAX_PACKET_LEN);
 
-        skb_trim(skb, len);
+        if (len <= MAX_PACKET_LEN) {
+                unsigned int i;
 
+                for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
+                        give_a_page(dev->priv, skb_shinfo(skb)->frags[i].page);
+                skb->data_len = 0;
+                skb_shinfo(skb)->nr_frags = 0;
+        }
+
+        err = pskb_trim(skb, len);
+        if (err) {
+                pr_debug("%s: pskb_trim failed %i %d\n", dev->name, len, err);
+                dev->stats.rx_dropped++;
+                goto drop;
+        }
+        skb->truesize += skb->data_len;
         dev->stats.rx_bytes += skb->len;
         dev->stats.rx_packets++;
 
@@ -160,7 +198,7 @@ static void try_fill_recv(struct virtnet_info *vi)
 {
         struct sk_buff *skb;
         struct scatterlist sg[2+MAX_SKB_FRAGS];
-        int num, err;
+        int num, err, i;
 
         sg_init_table(sg, 2+MAX_SKB_FRAGS);
         for (;;) {
@@ -170,6 +208,24 @@ static void try_fill_recv(struct virtnet_info *vi)
 
                 skb_put(skb, MAX_PACKET_LEN);
                 vnet_hdr_to_sg(sg, skb);
+
+                if (vi->big_packets) {
+                        for (i = 0; i < MAX_SKB_FRAGS; i++) {
+                                skb_frag_t *f = &skb_shinfo(skb)->frags[i];
+                                f->page = get_a_page(vi, GFP_ATOMIC);
+                                if (!f->page)
+                                        break;
+
+                                f->page_offset = 0;
+                                f->size = PAGE_SIZE;
+
+                                skb->data_len += PAGE_SIZE;
+                                skb->len += PAGE_SIZE;
+
+                                skb_shinfo(skb)->nr_frags++;
+                        }
+                }
+
                 num = skb_to_sgvec(skb, sg+1, 0, skb->len) + 1;
                 skb_queue_head(&vi->recv, skb);
 
@@ -335,16 +391,11 @@ again:
         free_old_xmit_skbs(vi);
 
         /* If we has a buffer left over from last time, send it now. */
-        if (unlikely(vi->last_xmit_skb)) {
-                if (xmit_skb(vi, vi->last_xmit_skb) != 0) {
-                        /* Drop this skb: we only queue one. */
-                        vi->dev->stats.tx_dropped++;
-                        kfree_skb(skb);
-                        skb = NULL;
-                        goto stop_queue;
-                }
-                vi->last_xmit_skb = NULL;
-        }
+        if (unlikely(vi->last_xmit_skb) &&
+            xmit_skb(vi, vi->last_xmit_skb) != 0)
+                goto stop_queue;
+
+        vi->last_xmit_skb = NULL;
 
         /* Put new one in send queue and do transmit */
         if (likely(skb)) {
@@ -370,6 +421,11 @@ stop_queue:
                 netif_start_queue(dev);
                 goto again;
         }
+        if (skb) {
+                /* Drop this skb: we only queue one. */
+                vi->dev->stats.tx_dropped++;
+                kfree_skb(skb);
+        }
         goto done;
 }
 
@@ -408,6 +464,22 @@ static int virtnet_close(struct net_device *dev)
         return 0;
 }
 
+static int virtnet_set_tx_csum(struct net_device *dev, u32 data)
+{
+        struct virtnet_info *vi = netdev_priv(dev);
+        struct virtio_device *vdev = vi->vdev;
+
+        if (data && !virtio_has_feature(vdev, VIRTIO_NET_F_CSUM))
+                return -ENOSYS;
+
+        return ethtool_op_set_tx_hw_csum(dev, data);
+}
+
+static struct ethtool_ops virtnet_ethtool_ops = {
+        .set_tx_csum = virtnet_set_tx_csum,
+        .set_sg = ethtool_op_set_sg,
+};
+
 static int virtnet_probe(struct virtio_device *vdev)
 {
         int err;
@@ -427,6 +499,7 @@ static int virtnet_probe(struct virtio_device *vdev)
 #ifdef CONFIG_NET_POLL_CONTROLLER
         dev->poll_controller = virtnet_netpoll;
 #endif
+        SET_ETHTOOL_OPS(dev, &virtnet_ethtool_ops);
         SET_NETDEV_DEV(dev, &vdev->dev);
 
         /* Do we support "hardware" checksums? */
@@ -462,11 +535,18 @@ static int virtnet_probe(struct virtio_device *vdev)
         vi->dev = dev;
         vi->vdev = vdev;
         vdev->priv = vi;
+        vi->pages = NULL;
 
         /* If they give us a callback when all buffers are done, we don't need
          * the timer. */
         vi->free_in_tasklet = virtio_has_feature(vdev,VIRTIO_F_NOTIFY_ON_EMPTY);
 
+        /* If we can receive ANY GSO packets, we must allocate large ones. */
+        if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4)
+            || virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6)
+            || virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
+                vi->big_packets = true;
+
         /* We expect two virtqueues, receive then send. */
         vi->rvq = vdev->config->find_vq(vdev, 0, skb_recv_done);
         if (IS_ERR(vi->rvq)) {
@@ -541,6 +621,10 @@ static void virtnet_remove(struct virtio_device *vdev)
         vdev->config->del_vq(vi->svq);
         vdev->config->del_vq(vi->rvq);
         unregister_netdev(vi->dev);
+
+        while (vi->pages)
+                __free_pages(get_a_page(vi, GFP_KERNEL), 0);
+
         free_netdev(vi->dev);
 }
 
@@ -553,7 +637,9 @@ static unsigned int features[] = {
         VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM,
         VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC,
         VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6,
-        VIRTIO_NET_F_HOST_ECN, VIRTIO_F_NOTIFY_ON_EMPTY,
+        VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6,
+        VIRTIO_NET_F_GUEST_ECN, /* We don't yet handle UFO input. */
+        VIRTIO_F_NOTIFY_ON_EMPTY,
 };
 
 static struct virtio_driver virtio_net = {