Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Synchronize with 'net' in order to sort out some l2tp, wireless, and
ipv6 GRE fixes that will be built on top of in 'net-next'.

Signed-off-by: David S. Miller <davem@davemloft.net>

11 files changed, 135 insertions, 86 deletions

diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 2d7b9377883a..b9dde139dac5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -380,7 +380,7 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
                 }
         }
 
-        if ((dev_cap->flags &
+        if ((dev->caps.flags &
             (MLX4_DEV_CAP_FLAG_64B_CQE | MLX4_DEV_CAP_FLAG_64B_EQE)) &&
             mlx4_is_master(dev))
                 dev->caps.function_caps |= MLX4_FUNC_CAP_64B_EQE_CQE;
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index b5ad7eadc4fa..d7115eca5efe 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1215,6 +1215,9 @@ static const struct usb_device_id cdc_devs[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x46),
           .driver_info = (unsigned long)&wwan_info,
         },
+        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x76),
+          .driver_info = (unsigned long)&wwan_info,
+        },
 
         /* Infineon(now Intel) HSPA Modem platform */
         { USB_DEVICE_AND_INTERFACE_INFO(0x1519, 0x0443,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 2ca7f8ea2dca..c8e05e27f38c 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -351,6 +351,10 @@ static const struct usb_device_id products[] = {
                 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 57),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
         },
+        {       /* HUAWEI_INTERFACE_NDIS_CONTROL_QUALCOMM */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x69),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
 
         /* 2. Combined interface devices matching on class+protocol */
         {       /* Huawei E367 and possibly others in "Windows mode" */
@@ -361,6 +365,14 @@ static const struct usb_device_id products[] = {
                 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 17),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
         },
+        {       /* HUAWEI_NDIS_SINGLE_INTERFACE_VDF */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x37),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
+        {       /* HUAWEI_INTERFACE_NDIS_HW_QUALCOMM */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x67),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
         {       /* Pantech UML290, P4200 and more */
                 USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf0, 0xff),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index b1dd5600fd02..c6451c61407a 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -36,6 +36,7 @@
 #include "debug.h"
 
 #define N_TX_QUEUES     4 /* #tx queues on mac80211<->driver interface */
+#define BRCMS_FLUSH_TIMEOUT     500 /* msec */
 
 /* Flags we support */
 #define MAC_FILTERS (FIF_PROMISC_IN_BSS | \
@@ -712,16 +713,29 @@ static void brcms_ops_rfkill_poll(struct ieee80211_hw *hw)
         wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, blocked);
 }
 
+static bool brcms_tx_flush_completed(struct brcms_info *wl)
+{
+        bool result;
+
+        spin_lock_bh(&wl->lock);
+        result = brcms_c_tx_flush_completed(wl->wlc);
+        spin_unlock_bh(&wl->lock);
+        return result;
+}
+
 static void brcms_ops_flush(struct ieee80211_hw *hw, bool drop)
 {
         struct brcms_info *wl = hw->priv;
+        int ret;
 
         no_printk("%s: drop = %s\n", __func__, drop ? "true" : "false");
 
-        /* wait for packet queue and dma fifos to run empty */
-        spin_lock_bh(&wl->lock);
-        brcms_c_wait_for_tx_completion(wl->wlc, drop);
-        spin_unlock_bh(&wl->lock);
+        ret = wait_event_timeout(wl->tx_flush_wq,
+                                 brcms_tx_flush_completed(wl),
+                                 msecs_to_jiffies(BRCMS_FLUSH_TIMEOUT));
+
+        brcms_dbg_mac80211(wl->wlc->hw->d11core,
+                           "ret=%d\n", jiffies_to_msecs(ret));
 }
 
 static const struct ieee80211_ops brcms_ops = {
@@ -776,6 +790,7 @@ void brcms_dpc(unsigned long data)
 
  done:
         spin_unlock_bh(&wl->lock);
+        wake_up(&wl->tx_flush_wq);
 }
 
 /*
@@ -1024,6 +1039,8 @@ static struct brcms_info *brcms_attach(struct bcma_device *pdev)
 
         atomic_set(&wl->callbacks, 0);
 
+        init_waitqueue_head(&wl->tx_flush_wq);
+
         /* setup the bottom half handler */
         tasklet_init(&wl->tasklet, brcms_dpc, (unsigned long) wl);
 
@@ -1613,13 +1630,3 @@ bool brcms_rfkill_set_hw_state(struct brcms_info *wl)
         spin_lock_bh(&wl->lock);
         return blocked;
 }
-
-/*
- * precondition: perimeter lock has been acquired
- */
-void brcms_msleep(struct brcms_info *wl, uint ms)
-{
-        spin_unlock_bh(&wl->lock);
-        msleep(ms);
-        spin_lock_bh(&wl->lock);
-}
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
index 9358bd5ebd35..947ccacf43e6 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
@@ -68,6 +68,8 @@ struct brcms_info {
         spinlock_t lock;        /* per-device perimeter lock */
         spinlock_t isr_lock;    /* per-device ISR synchronization lock */
 
+        /* tx flush */
+        wait_queue_head_t tx_flush_wq;
 
         /* timer related fields */
         atomic_t callbacks;     /* # outstanding callback functions */
@@ -100,7 +102,6 @@ extern struct brcms_timer *brcms_init_timer(struct brcms_info *wl,
 extern void brcms_free_timer(struct brcms_timer *timer);
 extern void brcms_add_timer(struct brcms_timer *timer, uint ms, int periodic);
 extern bool brcms_del_timer(struct brcms_timer *timer);
-extern void brcms_msleep(struct brcms_info *wl, uint ms);
 extern void brcms_dpc(unsigned long data);
 extern void brcms_timer(struct brcms_timer *t);
 extern void brcms_fatal_error(struct brcms_info *wl);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 8d560b64516d..62be5502b95d 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -7510,25 +7510,16 @@ int brcms_c_get_curband(struct brcms_c_info *wlc)
         return wlc->band->bandunit;
 }
 
-void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc, bool drop)
+bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc)
 {
-        int timeout = 20;
         int i;
 
         /* Kick DMA to send any pending AMPDU */
         for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
                 if (wlc->hw->di[i])
-                        dma_txflush(wlc->hw->di[i]);
+                        dma_kick_tx(wlc->hw->di[i]);
 
-        /* wait for queue and DMA fifos to run dry */
-        while (brcms_txpktpendtot(wlc) > 0) {
-                brcms_msleep(wlc->wl, 1);
-
-                if (--timeout == 0)
-                        break;
-        }
-
-        WARN_ON_ONCE(timeout == 0);
+        return !brcms_txpktpendtot(wlc);
 }
 
 void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pub.h b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
index 4fb2834f4e64..b0f14b7b8616 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
@@ -314,8 +314,6 @@ extern void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state);
 extern void brcms_c_scan_start(struct brcms_c_info *wlc);
 extern void brcms_c_scan_stop(struct brcms_c_info *wlc);
 extern int brcms_c_get_curband(struct brcms_c_info *wlc);
-extern void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc,
-                                           bool drop);
 extern int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel);
 extern int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl);
 extern void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
@@ -332,5 +330,6 @@ extern int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr);
 extern int brcms_c_get_tx_power(struct brcms_c_info *wlc);
 extern bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc);
 extern void brcms_c_mute(struct brcms_c_info *wlc, bool on);
+extern bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc);
 
 #endif                          /* _BRCM_PUB_H_ */
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 4494d130b37c..0f8b05185eda 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1004,7 +1004,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                                          is_tx ? "Tx" : "Rx");
 
                                 if (is_tx) {
-                                        rtl_lps_leave(hw);
+                                        schedule_work(&rtlpriv->
+                                                      works.lps_leave_work);
                                         ppsc->last_delaylps_stamp_jiffies =
                                             jiffies;
                                 }
@@ -1014,7 +1015,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                 }
         } else if (ETH_P_ARP == ether_type) {
                 if (is_tx) {
-                        rtl_lps_leave(hw);
+                        schedule_work(&rtlpriv->works.lps_leave_work);
                         ppsc->last_delaylps_stamp_jiffies = jiffies;
                 }
 
@@ -1024,7 +1025,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                          "802.1X %s EAPOL pkt!!\n", is_tx ? "Tx" : "Rx");
 
                 if (is_tx) {
-                        rtl_lps_leave(hw);
+                        schedule_work(&rtlpriv->works.lps_leave_work);
                         ppsc->last_delaylps_stamp_jiffies = jiffies;
                 }
 
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 94b79c3338c4..9d7f1723dd8f 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -151,6 +151,9 @@ void xen_netbk_queue_tx_skb(struct xenvif *vif, struct sk_buff *skb);
 /* Notify xenvif that ring now has space to send an skb to the frontend */
 void xenvif_notify_tx_completion(struct xenvif *vif);
 
+/* Prevent the device from generating any further traffic. */
+void xenvif_carrier_off(struct xenvif *vif);
+
 /* Returns number of ring slots required to send an skb to the frontend */
 unsigned int xen_netbk_count_skb_slots(struct xenvif *vif, struct sk_buff *skb);
 
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index f733cae3d4b6..fc1b8d78f4bc 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -345,17 +345,22 @@ err:
         return err;
 }
 
-void xenvif_disconnect(struct xenvif *vif)
+void xenvif_carrier_off(struct xenvif *vif)
 {
         struct net_device *dev = vif->dev;
-        if (netif_carrier_ok(dev)) {
-                rtnl_lock();
-                netif_carrier_off(dev); /* discard queued packets */
-                if (netif_running(dev))
-                        xenvif_down(vif);
-                rtnl_unlock();
-                xenvif_put(vif);
-        }
+
+        rtnl_lock();
+        netif_carrier_off(dev); /* discard queued packets */
+        if (netif_running(dev))
+                xenvif_down(vif);
+        rtnl_unlock();
+        xenvif_put(vif);
+}
+
+void xenvif_disconnect(struct xenvif *vif)
+{
+        if (netif_carrier_ok(vif->dev))
+                xenvif_carrier_off(vif);
 
         atomic_dec(&vif->refcnt);
         wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index f2d6b78d901d..2b9520c46e97 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -147,7 +147,8 @@ void xen_netbk_remove_xenvif(struct xenvif *vif)
         atomic_dec(&netbk->netfront_count);
 }
 
-static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx);
+static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx,
+                                  u8 status);
 static void make_tx_response(struct xenvif *vif,
                              struct xen_netif_tx_request *txp,
                              s8       st);
@@ -879,7 +880,7 @@ static void netbk_tx_err(struct xenvif *vif,
 
         do {
                 make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-                if (cons >= end)
+                if (cons == end)
                         break;
                 txp = RING_GET_REQUEST(&vif->tx, cons++);
         } while (1);
@@ -888,6 +889,13 @@ static void netbk_tx_err(struct xenvif *vif,
         xenvif_put(vif);
 }
 
+static void netbk_fatal_tx_err(struct xenvif *vif)
+{
+        netdev_err(vif->dev, "fatal error; disabling device\n");
+        xenvif_carrier_off(vif);
+        xenvif_put(vif);
+}
+
 static int netbk_count_requests(struct xenvif *vif,
                                 struct xen_netif_tx_request *first,
                                 struct xen_netif_tx_request *txp,
@@ -901,19 +909,22 @@ static int netbk_count_requests(struct xenvif *vif,
 
         do {
                 if (frags >= work_to_do) {
-                        netdev_dbg(vif->dev, "Need more frags\n");
+                        netdev_err(vif->dev, "Need more frags\n");
+                        netbk_fatal_tx_err(vif);
                         return -frags;
                 }
 
                 if (unlikely(frags >= MAX_SKB_FRAGS)) {
-                        netdev_dbg(vif->dev, "Too many frags\n");
+                        netdev_err(vif->dev, "Too many frags\n");
+                        netbk_fatal_tx_err(vif);
                         return -frags;
                 }
 
                 memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + frags),
                        sizeof(*txp));
                 if (txp->size > first->size) {
-                        netdev_dbg(vif->dev, "Frags galore\n");
+                        netdev_err(vif->dev, "Frag is bigger than frame.\n");
+                        netbk_fatal_tx_err(vif);
                         return -frags;
                 }
 
@@ -921,8 +932,9 @@ static int netbk_count_requests(struct xenvif *vif,
                 frags++;
 
                 if (unlikely((txp->offset + txp->size) > PAGE_SIZE)) {
-                        netdev_dbg(vif->dev, "txp->offset: %x, size: %u\n",
+                        netdev_err(vif->dev, "txp->offset: %x, size: %u\n",
                                  txp->offset, txp->size);
+                        netbk_fatal_tx_err(vif);
                         return -frags;
                 }
         } while ((txp++)->flags & XEN_NETTXF_more_data);
@@ -966,7 +978,7 @@ static struct gnttab_copy *xen_netbk_get_requests(struct xen_netbk *netbk,
                 pending_idx = netbk->pending_ring[index];
                 page = xen_netbk_alloc_page(netbk, skb, pending_idx);
                 if (!page)
-                        return NULL;
+                        goto err;
 
                 gop->source.u.ref = txp->gref;
                 gop->source.domid = vif->domid;
@@ -988,6 +1000,17 @@ static struct gnttab_copy *xen_netbk_get_requests(struct xen_netbk *netbk,
         }
 
         return gop;
+err:
+        /* Unwind, freeing all pages and sending error responses. */
+        while (i-- > start) {
+                xen_netbk_idx_release(netbk, frag_get_pending_idx(&frags[i]),
+                                      XEN_NETIF_RSP_ERROR);
+        }
+        /* The head too, if necessary. */
+        if (start)
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
+
+        return NULL;
 }
 
 static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
@@ -996,30 +1019,20 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
 {
         struct gnttab_copy *gop = *gopp;
         u16 pending_idx = *((u16 *)skb->data);
-        struct pending_tx_info *pending_tx_info = netbk->pending_tx_info;
-        struct xenvif *vif = pending_tx_info[pending_idx].vif;
-        struct xen_netif_tx_request *txp;
         struct skb_shared_info *shinfo = skb_shinfo(skb);
         int nr_frags = shinfo->nr_frags;
         int i, err, start;
 
         /* Check status of header. */
         err = gop->status;
-        if (unlikely(err)) {
-                pending_ring_idx_t index;
-                index = pending_index(netbk->pending_prod++);
-                txp = &pending_tx_info[pending_idx].req;
-                make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-                netbk->pending_ring[index] = pending_idx;
-                xenvif_put(vif);
-        }
+        if (unlikely(err))
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
 
         /* Skip first skb fragment if it is on same page as header fragment. */
         start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);
 
         for (i = start; i < nr_frags; i++) {
                 int j, newerr;
-                pending_ring_idx_t index;
 
                 pending_idx = frag_get_pending_idx(&shinfo->frags[i]);
 
@@ -1028,16 +1041,12 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
                 if (likely(!newerr)) {
                         /* Had a previous error? Invalidate this fragment. */
                         if (unlikely(err))
-                                xen_netbk_idx_release(netbk, pending_idx);
+                                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                         continue;
                 }
 
                 /* Error on this fragment: respond to client with an error. */
-                txp = &netbk->pending_tx_info[pending_idx].req;
-                make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-                index = pending_index(netbk->pending_prod++);
-                netbk->pending_ring[index] = pending_idx;
-                xenvif_put(vif);
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
 
                 /* Not the first error? Preceding frags already invalidated. */
                 if (err)
@@ -1045,10 +1054,10 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
 
                 /* First error: invalidate header and preceding fragments. */
                 pending_idx = *((u16 *)skb->data);
-                xen_netbk_idx_release(netbk, pending_idx);
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                 for (j = start; j < i; j++) {
                         pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
-                        xen_netbk_idx_release(netbk, pending_idx);
+                        xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                 }
 
                 /* Remember the error: invalidate all subsequent fragments. */
@@ -1082,7 +1091,7 @@ static void xen_netbk_fill_frags(struct xen_netbk *netbk, struct sk_buff *skb)
 
                 /* Take an extra reference to offset xen_netbk_idx_release */
                 get_page(netbk->mmap_pages[pending_idx]);
-                xen_netbk_idx_release(netbk, pending_idx);
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
         }
 }
 
@@ -1095,7 +1104,8 @@ static int xen_netbk_get_extras(struct xenvif *vif,
 
         do {
                 if (unlikely(work_to_do-- <= 0)) {
-                        netdev_dbg(vif->dev, "Missing extra info\n");
+                        netdev_err(vif->dev, "Missing extra info\n");
+                        netbk_fatal_tx_err(vif);
                         return -EBADR;
                 }
 
@@ -1104,8 +1114,9 @@ static int xen_netbk_get_extras(struct xenvif *vif,
                 if (unlikely(!extra.type ||
                              extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
                         vif->tx.req_cons = ++cons;
-                        netdev_dbg(vif->dev,
+                        netdev_err(vif->dev,
                                    "Invalid extra type: %d\n", extra.type);
+                        netbk_fatal_tx_err(vif);
                         return -EINVAL;
                 }
 
@@ -1121,13 +1132,15 @@ static int netbk_set_skb_gso(struct xenvif *vif,
                              struct xen_netif_extra_info *gso)
 {
         if (!gso->u.gso.size) {
-                netdev_dbg(vif->dev, "GSO size must not be zero.\n");
+                netdev_err(vif->dev, "GSO size must not be zero.\n");
+                netbk_fatal_tx_err(vif);
                 return -EINVAL;
         }
 
         /* Currently only TCPv4 S.O. is supported. */
         if (gso->u.gso.type != XEN_NETIF_GSO_TYPE_TCPV4) {
-                netdev_dbg(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type);
+                netdev_err(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type);
+                netbk_fatal_tx_err(vif);
                 return -EINVAL;
         }
 
@@ -1264,9 +1277,25 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
 
                 /* Get a netif from the list with work to do. */
                 vif = poll_net_schedule_list(netbk);
+                /* This can sometimes happen because the test of
+                 * list_empty(net_schedule_list) at the top of the
+                 * loop is unlocked.  Just go back and have another
+                 * look.
+                 */
                 if (!vif)
                         continue;
 
+                if (vif->tx.sring->req_prod - vif->tx.req_cons >
+                    XEN_NETIF_TX_RING_SIZE) {
+                        netdev_err(vif->dev,
+                                   "Impossible number of requests. "
+                                   "req_prod %d, req_cons %d, size %ld\n",
+                                   vif->tx.sring->req_prod, vif->tx.req_cons,
+                                   XEN_NETIF_TX_RING_SIZE);
+                        netbk_fatal_tx_err(vif);
+                        continue;
+                }
+
                 RING_FINAL_CHECK_FOR_REQUESTS(&vif->tx, work_to_do);
                 if (!work_to_do) {
                         xenvif_put(vif);
@@ -1294,17 +1323,14 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
                         work_to_do = xen_netbk_get_extras(vif, extras,
                                                           work_to_do);
                         idx = vif->tx.req_cons;
-                        if (unlikely(work_to_do < 0)) {
-                                netbk_tx_err(vif, &txreq, idx);
+                        if (unlikely(work_to_do < 0))
                                 continue;
-                        }
                 }
 
                 ret = netbk_count_requests(vif, &txreq, txfrags, work_to_do);
-                if (unlikely(ret < 0)) {
-                        netbk_tx_err(vif, &txreq, idx - ret);
+                if (unlikely(ret < 0))
                         continue;
-                }
+
                 idx += ret;
 
                 if (unlikely(txreq.size < ETH_HLEN)) {
@@ -1316,11 +1342,11 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
 
                 /* No crossing a page as the payload mustn't fragment. */
                 if (unlikely((txreq.offset + txreq.size) > PAGE_SIZE)) {
-                        netdev_dbg(vif->dev,
+                        netdev_err(vif->dev,
                                    "txreq.offset: %x, size: %u, end: %lu\n",
                                    txreq.offset, txreq.size,
                                    (txreq.offset&~PAGE_MASK) + txreq.size);
-                        netbk_tx_err(vif, &txreq, idx);
+                        netbk_fatal_tx_err(vif);
                         continue;
                 }
 
@@ -1348,8 +1374,8 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
                         gso = &extras[XEN_NETIF_EXTRA_TYPE_GSO - 1];
 
                         if (netbk_set_skb_gso(vif, skb, gso)) {
+                                /* Failure in netbk_set_skb_gso is fatal. */
                                 kfree_skb(skb);
-                                netbk_tx_err(vif, &txreq, idx);
                                 continue;
                         }
                 }
@@ -1448,7 +1474,7 @@ static void xen_netbk_tx_submit(struct xen_netbk *netbk)
                         txp->size -= data_len;
                 } else {
                         /* Schedule a response immediately. */
-                        xen_netbk_idx_release(netbk, pending_idx);
+                        xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                 }
 
                 if (txp->flags & XEN_NETTXF_csum_blank)
@@ -1500,7 +1526,8 @@ static void xen_netbk_tx_action(struct xen_netbk *netbk)
         xen_netbk_tx_submit(netbk);
 }
 
-static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx)
+static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx,
+                                  u8 status)
 {
         struct xenvif *vif;
         struct pending_tx_info *pending_tx_info;
@@ -1514,7 +1541,7 @@ static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx)
 
         vif = pending_tx_info->vif;
 
-        make_tx_response(vif, &pending_tx_info->req, XEN_NETIF_RSP_OKAY);
+        make_tx_response(vif, &pending_tx_info->req, status);
 
         index = pending_index(netbk->pending_prod++);
         netbk->pending_ring[index] = pending_idx;