5 files changed, 366 insertions, 68 deletions

diff --git a/arch/sparc/include/asm/vio.h b/arch/sparc/include/asm/vio.h
index e0f6c399f1d0..6b135a8ab07b 100644
--- a/arch/sparc/include/asm/vio.h
+++ b/arch/sparc/include/asm/vio.h
@@ -65,6 +65,7 @@ struct vio_dring_register {
         u16                     options;
 #define VIO_TX_DRING            0x0001
 #define VIO_RX_DRING            0x0002
+#define VIO_RX_DRING_DATA       0x0004
         u16                     resv;
         u32                     num_cookies;
         struct ldc_trans_cookie cookies[0];
@@ -80,6 +81,8 @@ struct vio_dring_unregister {
 #define VIO_PKT_MODE            0x01 /* Packet based transfer   */
 #define VIO_DESC_MODE           0x02 /* In-band descriptors     */
 #define VIO_DRING_MODE          0x03 /* Descriptor rings        */
+/* in vers >= 1.2, VIO_DRING_MODE is 0x04 and transfer mode is a bitmask */
+#define VIO_NEW_DRING_MODE      0x04
 
 struct vio_dring_data {
         struct vio_msg_tag      tag;
@@ -205,10 +208,20 @@ struct vio_net_attr_info {
         u8                      addr_type;
 #define VNET_ADDR_ETHERMAC      0x01
         u16                     ack_freq;
-        u32                     resv1;
+        u8                      plnk_updt;
+#define PHYSLINK_UPDATE_NONE            0x00
+#define PHYSLINK_UPDATE_STATE           0x01
+#define PHYSLINK_UPDATE_STATE_ACK       0x02
+#define PHYSLINK_UPDATE_STATE_NACK      0x03
+        u8                      options;
+        u16                     resv1;
         u64                     addr;
         u64                     mtu;
-        u64                     resv2[3];
+        u16                     cflags;
+#define VNET_LSO_IPV4_CAPAB             0x0001
+        u16                     ipv4_lso_maxlen;
+        u32                     resv2;
+        u64                     resv3[2];
 };
 
 #define VNET_NUM_MCAST          7
@@ -366,6 +379,33 @@ struct vio_driver_state {
         struct vio_driver_ops   *ops;
 };
 
+static inline bool vio_version_before(struct vio_driver_state *vio,
+                                      u16 major, u16 minor)
+{
+        u32 have = (u32)vio->ver.major << 16 | vio->ver.minor;
+        u32 want = (u32)major << 16 | minor;
+
+        return have < want;
+}
+
+static inline bool vio_version_after(struct vio_driver_state *vio,
+                                      u16 major, u16 minor)
+{
+        u32 have = (u32)vio->ver.major << 16 | vio->ver.minor;
+        u32 want = (u32)major << 16 | minor;
+
+        return have > want;
+}
+
+static inline bool vio_version_after_eq(struct vio_driver_state *vio,
+                                        u16 major, u16 minor)
+{
+        u32 have = (u32)vio->ver.major << 16 | vio->ver.minor;
+        u32 want = (u32)major << 16 | minor;
+
+        return have >= want;
+}
+
 #define viodbg(TYPE, f, a...) \
 do {    if (vio->debug & VIO_DEBUG_##TYPE) \
                 printk(KERN_INFO "vio: ID[%lu] " f, \
diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
index 66dacd56bb10..0af28b984695 100644
--- a/arch/sparc/kernel/ldc.c
+++ b/arch/sparc/kernel/ldc.c
@@ -2159,7 +2159,7 @@ int ldc_map_single(struct ldc_channel *lp,
         state.pte_idx = (base - iommu->page_table);
         state.nc = 0;
         fill_cookies(&state, (pa & PAGE_MASK), (pa & ~PAGE_MASK), len);
-        BUG_ON(state.nc != 1);
+        BUG_ON(state.nc > ncookies);
 
         return state.nc;
 }
diff --git a/arch/sparc/kernel/viohs.c b/arch/sparc/kernel/viohs.c
index f8e7dd53e1c7..7ef081a185b1 100644
--- a/arch/sparc/kernel/viohs.c
+++ b/arch/sparc/kernel/viohs.c
@@ -426,6 +426,13 @@ static int process_dreg_info(struct vio_driver_state *vio,
         if (vio->dr_state & VIO_DR_STATE_RXREG)
                 goto send_nack;
 
+        /* v1.6 and higher, ACK with desired, supported mode, or NACK */
+        if (vio_version_after_eq(vio, 1, 6)) {
+                if (!(pkt->options & VIO_TX_DRING))
+                        goto send_nack;
+                pkt->options = VIO_TX_DRING;
+        }
+
         BUG_ON(vio->desc_buf);
 
         vio->desc_buf = kzalloc(pkt->descr_size, GFP_ATOMIC);
@@ -453,8 +460,11 @@ static int process_dreg_info(struct vio_driver_state *vio,
         pkt->tag.stype = VIO_SUBTYPE_ACK;
         pkt->dring_ident = ++dr->ident;
 
-        viodbg(HS, "SEND DRING_REG ACK ident[%llx]\n",
-               (unsigned long long) pkt->dring_ident);
+        viodbg(HS, "SEND DRING_REG ACK ident[%llx] "
+               "ndesc[%u] dsz[%u] opt[0x%x] ncookies[%u]\n",
+               (unsigned long long) pkt->dring_ident,
+               pkt->num_descr, pkt->descr_size, pkt->options,
+               pkt->num_cookies);
 
         len = (sizeof(*pkt) +
                (dr->ncookies * sizeof(struct ldc_trans_cookie)));
diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
index edb860947da4..126269762ee7 100644
--- a/drivers/net/ethernet/sun/sunvnet.c
+++ b/drivers/net/ethernet/sun/sunvnet.c
@@ -15,6 +15,14 @@
 #include <linux/ethtool.h>
 #include <linux/etherdevice.h>
 #include <linux/mutex.h>
+#include <linux/if_vlan.h>
+
+#if IS_ENABLED(CONFIG_IPV6)
+#include <linux/icmpv6.h>
+#endif
+
+#include <net/icmp.h>
+#include <net/route.h>
 
 #include <asm/vio.h>
 #include <asm/ldc.h>
@@ -41,6 +49,7 @@ static int __vnet_tx_trigger(struct vnet_port *port, u32 start);
 
 /* Ordered from largest major to lowest */
 static struct vio_version vnet_versions[] = {
+        { .major = 1, .minor = 6 },
         { .major = 1, .minor = 0 },
 };
 
@@ -67,6 +76,7 @@ static int vnet_send_attr(struct vio_driver_state *vio)
         struct vnet_port *port = to_vnet_port(vio);
         struct net_device *dev = port->vp->dev;
         struct vio_net_attr_info pkt;
+        int framelen = ETH_FRAME_LEN;
         int i;
 
         memset(&pkt, 0, sizeof(pkt));
@@ -74,19 +84,41 @@ static int vnet_send_attr(struct vio_driver_state *vio)
         pkt.tag.stype = VIO_SUBTYPE_INFO;
         pkt.tag.stype_env = VIO_ATTR_INFO;
         pkt.tag.sid = vio_send_sid(vio);
-        pkt.xfer_mode = VIO_DRING_MODE;
+        if (vio_version_before(vio, 1, 2))
+                pkt.xfer_mode = VIO_DRING_MODE;
+        else
+                pkt.xfer_mode = VIO_NEW_DRING_MODE;
         pkt.addr_type = VNET_ADDR_ETHERMAC;
         pkt.ack_freq = 0;
         for (i = 0; i < 6; i++)
                 pkt.addr |= (u64)dev->dev_addr[i] << ((5 - i) * 8);
-        pkt.mtu = ETH_FRAME_LEN;
+        if (vio_version_after(vio, 1, 3)) {
+                if (port->rmtu) {
+                        port->rmtu = min(VNET_MAXPACKET, port->rmtu);
+                        pkt.mtu = port->rmtu;
+                } else {
+                        port->rmtu = VNET_MAXPACKET;
+                        pkt.mtu = port->rmtu;
+                }
+                if (vio_version_after_eq(vio, 1, 6))
+                        pkt.options = VIO_TX_DRING;
+        } else if (vio_version_before(vio, 1, 3)) {
+                pkt.mtu = framelen;
+        } else { /* v1.3 */
+                pkt.mtu = framelen + VLAN_HLEN;
+        }
+
+        pkt.plnk_updt = PHYSLINK_UPDATE_NONE;
+        pkt.cflags = 0;
 
         viodbg(HS, "SEND NET ATTR xmode[0x%x] atype[0x%x] addr[%llx] "
-               "ackfreq[%u] mtu[%llu]\n",
+               "ackfreq[%u] plnk_updt[0x%02x] opts[0x%02x] mtu[%llu] "
+               "cflags[0x%04x] lso_max[%u]\n",
                pkt.xfer_mode, pkt.addr_type,
-               (unsigned long long) pkt.addr,
-               pkt.ack_freq,
-               (unsigned long long) pkt.mtu);
+               (unsigned long long)pkt.addr,
+               pkt.ack_freq, pkt.plnk_updt, pkt.options,
+               (unsigned long long)pkt.mtu, pkt.cflags, pkt.ipv4_lso_maxlen);
+
 
         return vio_ldc_send(vio, &pkt, sizeof(pkt));
 }
@@ -94,18 +126,52 @@ static int vnet_send_attr(struct vio_driver_state *vio)
 static int handle_attr_info(struct vio_driver_state *vio,
                             struct vio_net_attr_info *pkt)
 {
-        viodbg(HS, "GOT NET ATTR INFO xmode[0x%x] atype[0x%x] addr[%llx] "
-               "ackfreq[%u] mtu[%llu]\n",
+        struct vnet_port *port = to_vnet_port(vio);
+        u64     localmtu;
+        u8      xfer_mode;
+
+        viodbg(HS, "GOT NET ATTR xmode[0x%x] atype[0x%x] addr[%llx] "
+               "ackfreq[%u] plnk_updt[0x%02x] opts[0x%02x] mtu[%llu] "
+               " (rmtu[%llu]) cflags[0x%04x] lso_max[%u]\n",
                pkt->xfer_mode, pkt->addr_type,
-               (unsigned long long) pkt->addr,
-               pkt->ack_freq,
-               (unsigned long long) pkt->mtu);
+               (unsigned long long)pkt->addr,
+               pkt->ack_freq, pkt->plnk_updt, pkt->options,
+               (unsigned long long)pkt->mtu, port->rmtu, pkt->cflags,
+               pkt->ipv4_lso_maxlen);
 
         pkt->tag.sid = vio_send_sid(vio);
 
-        if (pkt->xfer_mode != VIO_DRING_MODE ||
+        xfer_mode = pkt->xfer_mode;
+        /* for version < 1.2, VIO_DRING_MODE = 0x3 and no bitmask */
+        if (vio_version_before(vio, 1, 2) && xfer_mode == VIO_DRING_MODE)
+                xfer_mode = VIO_NEW_DRING_MODE;
+
+        /* MTU negotiation:
+         *      < v1.3 - ETH_FRAME_LEN exactly
+         *      > v1.3 - MIN(pkt.mtu, VNET_MAXPACKET, port->rmtu) and change
+         *                      pkt->mtu for ACK
+         *      = v1.3 - ETH_FRAME_LEN + VLAN_HLEN exactly
+         */
+        if (vio_version_before(vio, 1, 3)) {
+                localmtu = ETH_FRAME_LEN;
+        } else if (vio_version_after(vio, 1, 3)) {
+                localmtu = port->rmtu ? port->rmtu : VNET_MAXPACKET;
+                localmtu = min(pkt->mtu, localmtu);
+                pkt->mtu = localmtu;
+        } else { /* v1.3 */
+                localmtu = ETH_FRAME_LEN + VLAN_HLEN;
+        }
+        port->rmtu = localmtu;
+
+        /* for version >= 1.6, ACK packet mode we support */
+        if (vio_version_after_eq(vio, 1, 6)) {
+                pkt->xfer_mode = VIO_NEW_DRING_MODE;
+                pkt->options = VIO_TX_DRING;
+        }
+
+        if (!(xfer_mode | VIO_NEW_DRING_MODE) ||
             pkt->addr_type != VNET_ADDR_ETHERMAC ||
-            pkt->mtu != ETH_FRAME_LEN) {
+            pkt->mtu != localmtu) {
                 viodbg(HS, "SEND NET ATTR NACK\n");
 
                 pkt->tag.stype = VIO_SUBTYPE_NACK;
@@ -114,7 +180,14 @@ static int handle_attr_info(struct vio_driver_state *vio,
 
                 return -ECONNRESET;
         } else {
-                viodbg(HS, "SEND NET ATTR ACK\n");
+                viodbg(HS, "SEND NET ATTR ACK xmode[0x%x] atype[0x%x] "
+                       "addr[%llx] ackfreq[%u] plnk_updt[0x%02x] opts[0x%02x] "
+                       "mtu[%llu] (rmtu[%llu]) cflags[0x%04x] lso_max[%u]\n",
+                       pkt->xfer_mode, pkt->addr_type,
+                       (unsigned long long)pkt->addr,
+                       pkt->ack_freq, pkt->plnk_updt, pkt->options,
+                       (unsigned long long)pkt->mtu, port->rmtu, pkt->cflags,
+                       pkt->ipv4_lso_maxlen);
 
                 pkt->tag.stype = VIO_SUBTYPE_ACK;
 
@@ -210,7 +283,7 @@ static int vnet_rx_one(struct vnet_port *port, unsigned int len,
         int err;
 
         err = -EMSGSIZE;
-        if (unlikely(len < ETH_ZLEN || len > ETH_FRAME_LEN)) {
+        if (unlikely(len < ETH_ZLEN || len > port->rmtu)) {
                 dev->stats.rx_length_errors++;
                 goto out_dropped;
         }
@@ -558,8 +631,10 @@ static void vnet_event(void *arg, int event)
                 vio_link_state_change(vio, event);
                 spin_unlock_irqrestore(&vio->lock, flags);
 
-                if (event == LDC_EVENT_RESET)
+                if (event == LDC_EVENT_RESET) {
+                        port->rmtu = 0;
                         vio_port_up(vio);
+                }
                 return;
         }
 
@@ -712,6 +787,117 @@ struct vnet_port *tx_port_find(struct vnet *vp, struct sk_buff *skb)
         return ret;
 }
 
+static struct sk_buff *vnet_clean_tx_ring(struct vnet_port *port,
+                                          unsigned *pending)
+{
+        struct vio_dring_state *dr = &port->vio.drings[VIO_DRIVER_TX_RING];
+        struct sk_buff *skb = NULL;
+        int i, txi;
+
+        *pending = 0;
+
+        txi = dr->prod-1;
+        if (txi < 0)
+                txi = VNET_TX_RING_SIZE-1;
+
+        for (i = 0; i < VNET_TX_RING_SIZE; ++i) {
+                struct vio_net_desc *d;
+
+                d = vio_dring_entry(dr, txi);
+
+                if (d->hdr.state == VIO_DESC_DONE) {
+                        if (port->tx_bufs[txi].skb) {
+                                BUG_ON(port->tx_bufs[txi].skb->next);
+
+                                port->tx_bufs[txi].skb->next = skb;
+                                skb = port->tx_bufs[txi].skb;
+                                port->tx_bufs[txi].skb = NULL;
+
+                                ldc_unmap(port->vio.lp,
+                                          port->tx_bufs[txi].cookies,
+                                          port->tx_bufs[txi].ncookies);
+                        }
+                        d->hdr.state = VIO_DESC_FREE;
+                } else if (d->hdr.state == VIO_DESC_READY) {
+                        (*pending)++;
+                } else if (d->hdr.state == VIO_DESC_FREE) {
+                        break;
+                }
+                --txi;
+                if (txi < 0)
+                        txi = VNET_TX_RING_SIZE-1;
+        }
+        return skb;
+}
+
+static inline void vnet_free_skbs(struct sk_buff *skb)
+{
+        struct sk_buff *next;
+
+        while (skb) {
+                next = skb->next;
+                skb->next = NULL;
+                dev_kfree_skb(skb);
+                skb = next;
+        }
+}
+
+static void vnet_clean_timer_expire(unsigned long port0)
+{
+        struct vnet_port *port = (struct vnet_port *)port0;
+        struct sk_buff *freeskbs;
+        unsigned pending;
+        unsigned long flags;
+
+        spin_lock_irqsave(&port->vio.lock, flags);
+        freeskbs = vnet_clean_tx_ring(port, &pending);
+        spin_unlock_irqrestore(&port->vio.lock, flags);
+
+        vnet_free_skbs(freeskbs);
+
+        if (pending)
+                (void)mod_timer(&port->clean_timer,
+                                jiffies + VNET_CLEAN_TIMEOUT);
+         else
+                del_timer(&port->clean_timer);
+}
+
+static inline struct sk_buff *vnet_skb_shape(struct sk_buff *skb, void **pstart,
+                                             int *plen)
+{
+        struct sk_buff *nskb;
+        int len, pad;
+
+        len = skb->len;
+        pad = 0;
+        if (len < ETH_ZLEN) {
+                pad += ETH_ZLEN - skb->len;
+                len += pad;
+        }
+        len += VNET_PACKET_SKIP;
+        pad += 8 - (len & 7);
+        len += 8 - (len & 7);
+
+        if (((unsigned long)skb->data & 7) != VNET_PACKET_SKIP ||
+            skb_tailroom(skb) < pad ||
+            skb_headroom(skb) < VNET_PACKET_SKIP) {
+                nskb = alloc_and_align_skb(skb->dev, skb->len);
+                skb_reserve(nskb, VNET_PACKET_SKIP);
+                if (skb_copy_bits(skb, 0, nskb->data, skb->len)) {
+                        dev_kfree_skb(nskb);
+                        dev_kfree_skb(skb);
+                        return NULL;
+                }
+                (void)skb_put(nskb, skb->len);
+                dev_kfree_skb(skb);
+                skb = nskb;
+        }
+
+        *pstart = skb->data - VNET_PACKET_SKIP;
+        *plen = len;
+        return skb;
+}
+
 static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct vnet *vp = netdev_priv(dev);
@@ -720,12 +906,51 @@ static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct vio_net_desc *d;
         unsigned long flags;
         unsigned int len;
-        void *tx_buf;
-        int i, err;
+        struct sk_buff *freeskbs = NULL;
+        int i, err, txi;
+        void *start = NULL;
+        int nlen = 0;
+        unsigned pending = 0;
 
         if (unlikely(!port))
                 goto out_dropped;
 
+        skb = vnet_skb_shape(skb, &start, &nlen);
+
+        if (unlikely(!skb))
+                goto out_dropped;
+
+        if (skb->len > port->rmtu) {
+                unsigned long localmtu = port->rmtu - ETH_HLEN;
+
+                if (vio_version_after_eq(&port->vio, 1, 3))
+                        localmtu -= VLAN_HLEN;
+
+                if (skb->protocol == htons(ETH_P_IP)) {
+                        struct flowi4 fl4;
+                        struct rtable *rt = NULL;
+
+                        memset(&fl4, 0, sizeof(fl4));
+                        fl4.flowi4_oif = dev->ifindex;
+                        fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
+                        fl4.daddr = ip_hdr(skb)->daddr;
+                        fl4.saddr = ip_hdr(skb)->saddr;
+
+                        rt = ip_route_output_key(dev_net(dev), &fl4);
+                        if (!IS_ERR(rt)) {
+                                skb_dst_set(skb, &rt->dst);
+                                icmp_send(skb, ICMP_DEST_UNREACH,
+                                          ICMP_FRAG_NEEDED,
+                                          htonl(localmtu));
+                        }
+                }
+#if IS_ENABLED(CONFIG_IPV6)
+                else if (skb->protocol == htons(ETH_P_IPV6))
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, localmtu);
+#endif
+                goto out_dropped;
+        }
+
         spin_lock_irqsave(&port->vio.lock, flags);
 
         dr = &port->vio.drings[VIO_DRIVER_TX_RING];
@@ -743,14 +968,27 @@ static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         d = vio_dring_cur(dr);
 
-        tx_buf = port->tx_bufs[dr->prod].buf;
-        skb_copy_from_linear_data(skb, tx_buf + VNET_PACKET_SKIP, skb->len);
+        txi = dr->prod;
+
+        freeskbs = vnet_clean_tx_ring(port, &pending);
+
+        BUG_ON(port->tx_bufs[txi].skb);
 
         len = skb->len;
-        if (len < ETH_ZLEN) {
+        if (len < ETH_ZLEN)
                 len = ETH_ZLEN;
-                memset(tx_buf+VNET_PACKET_SKIP+skb->len, 0, len - skb->len);
+
+        port->tx_bufs[txi].skb = skb;
+        skb = NULL;
+
+        err = ldc_map_single(port->vio.lp, start, nlen,
+                             port->tx_bufs[txi].cookies, VNET_MAXCOOKIES,
+                             (LDC_MAP_SHADOW | LDC_MAP_DIRECT | LDC_MAP_RW));
+        if (err < 0) {
+                netdev_info(dev, "tx buffer map error %d\n", err);
+                goto out_dropped_unlock;
         }
+        port->tx_bufs[txi].ncookies = err;
 
         /* We don't rely on the ACKs to free the skb in vnet_start_xmit(),
          * thus it is safe to not set VIO_ACK_ENABLE for each transmission:
@@ -762,9 +1000,9 @@ static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
          */
         d->hdr.ack = VIO_ACK_DISABLE;
         d->size = len;
-        d->ncookies = port->tx_bufs[dr->prod].ncookies;
+        d->ncookies = port->tx_bufs[txi].ncookies;
         for (i = 0; i < d->ncookies; i++)
-                d->cookies[i] = port->tx_bufs[dr->prod].cookies[i];
+                d->cookies[i] = port->tx_bufs[txi].cookies[i];
 
         /* This has to be a non-SMP write barrier because we are writing
          * to memory which is shared with the peer LDOM.
@@ -808,7 +1046,7 @@ ldc_start_done:
         port->start_cons = false;
 
         dev->stats.tx_packets++;
-        dev->stats.tx_bytes += skb->len;
+        dev->stats.tx_bytes += port->tx_bufs[txi].skb->len;
 
         dr->prod = (dr->prod + 1) & (VNET_TX_RING_SIZE - 1);
         if (unlikely(vnet_tx_dring_avail(dr) < 2)) {
@@ -819,7 +1057,9 @@ ldc_start_done:
 
         spin_unlock_irqrestore(&port->vio.lock, flags);
 
-        dev_kfree_skb(skb);
+        vnet_free_skbs(freeskbs);
+
+        (void)mod_timer(&port->clean_timer, jiffies + VNET_CLEAN_TIMEOUT);
 
         return NETDEV_TX_OK;
 
@@ -827,7 +1067,14 @@ out_dropped_unlock:
         spin_unlock_irqrestore(&port->vio.lock, flags);
 
 out_dropped:
-        dev_kfree_skb(skb);
+        if (skb)
+                dev_kfree_skb(skb);
+        vnet_free_skbs(freeskbs);
+        if (pending)
+                (void)mod_timer(&port->clean_timer,
+                                jiffies + VNET_CLEAN_TIMEOUT);
+        else
+                del_timer(&port->clean_timer);
         dev->stats.tx_dropped++;
         return NETDEV_TX_OK;
 }
@@ -973,7 +1220,7 @@ static void vnet_set_rx_mode(struct net_device *dev)
 
 static int vnet_change_mtu(struct net_device *dev, int new_mtu)
 {
-        if (new_mtu != ETH_DATA_LEN)
+        if (new_mtu < 68 || new_mtu > 65535)
                 return -EINVAL;
 
         dev->mtu = new_mtu;
@@ -1029,17 +1276,22 @@ static void vnet_port_free_tx_bufs(struct vnet_port *port)
         }
 
         for (i = 0; i < VNET_TX_RING_SIZE; i++) {
-                void *buf = port->tx_bufs[i].buf;
+                struct vio_net_desc *d;
+                void *skb = port->tx_bufs[i].skb;
 
-                if (!buf)
+                if (!skb)
                         continue;
 
+                d = vio_dring_entry(dr, i);
+                if (d->hdr.state == VIO_DESC_READY)
+                        pr_warn("active transmit buffers freed\n");
+
                 ldc_unmap(port->vio.lp,
                           port->tx_bufs[i].cookies,
                           port->tx_bufs[i].ncookies);
-
-                kfree(buf);
-                port->tx_bufs[i].buf = NULL;
+                dev_kfree_skb(skb);
+                port->tx_bufs[i].skb = NULL;
+                d->hdr.state = VIO_DESC_FREE;
         }
 }
 
@@ -1050,34 +1302,6 @@ static int vnet_port_alloc_tx_bufs(struct vnet_port *port)
         int i, err, ncookies;
         void *dring;
 
-        for (i = 0; i < VNET_TX_RING_SIZE; i++) {
-                void *buf = kzalloc(ETH_FRAME_LEN + 8, GFP_KERNEL);
-                int map_len = (ETH_FRAME_LEN + 7) & ~7;
-
-                err = -ENOMEM;
-                if (!buf)
-                        goto err_out;
-
-                err = -EFAULT;
-                if ((unsigned long)buf & (8UL - 1)) {
-                        pr_err("TX buffer misaligned\n");
-                        kfree(buf);
-                        goto err_out;
-                }
-
-                err = ldc_map_single(port->vio.lp, buf, map_len,
-                                     port->tx_bufs[i].cookies, 2,
-                                     (LDC_MAP_SHADOW |
-                                      LDC_MAP_DIRECT |
-                                      LDC_MAP_RW));
-                if (err < 0) {
-                        kfree(buf);
-                        goto err_out;
-                }
-                port->tx_bufs[i].buf = buf;
-                port->tx_bufs[i].ncookies = err;
-        }
-
         dr = &port->vio.drings[VIO_DRIVER_TX_RING];
 
         len = (VNET_TX_RING_SIZE *
@@ -1104,6 +1328,12 @@ static int vnet_port_alloc_tx_bufs(struct vnet_port *port)
         dr->pending = VNET_TX_RING_SIZE;
         dr->ncookies = ncookies;
 
+        for (i = 0; i < VNET_TX_RING_SIZE; ++i) {
+                struct vio_net_desc *d;
+
+                d = vio_dring_entry(dr, i);
+                d->hdr.state = VIO_DESC_FREE;
+        }
         return 0;
 
 err_out:
@@ -1135,6 +1365,8 @@ static struct vnet *vnet_new(const u64 *local_mac)
         dev = alloc_etherdev(sizeof(*vp));
         if (!dev)
                 return ERR_PTR(-ENOMEM);
+        dev->needed_headroom = VNET_PACKET_SKIP + 8;
+        dev->needed_tailroom = 8;
 
         for (i = 0; i < ETH_ALEN; i++)
                 dev->dev_addr[i] = (*local_mac >> (5 - i) * 8) & 0xff;
@@ -1329,6 +1561,9 @@ static int vnet_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
         pr_info("%s: PORT ( remote-mac %pM%s )\n",
                 vp->dev->name, port->raddr, switch_port ? " switch-port" : "");
 
+        setup_timer(&port->clean_timer, vnet_clean_timer_expire,
+                    (unsigned long)port);
+
         vio_port_up(&port->vio);
 
         mdesc_release(hp);
@@ -1355,6 +1590,7 @@ static int vnet_port_remove(struct vio_dev *vdev)
                 unsigned long flags;
 
                 del_timer_sync(&port->vio.timer);
+                del_timer_sync(&port->clean_timer);
 
                 spin_lock_irqsave(&vp->lock, flags);
                 list_del(&port->list);
diff --git a/drivers/net/ethernet/sun/sunvnet.h b/drivers/net/ethernet/sun/sunvnet.h
index da4933750d06..c91104542619 100644
--- a/drivers/net/ethernet/sun/sunvnet.h
+++ b/drivers/net/ethernet/sun/sunvnet.h
@@ -11,6 +11,12 @@
  */
 #define VNET_TX_TIMEOUT                 (5 * HZ)
 
+/* length of time (or less) we expect pending descriptors to be marked
+ * as VIO_DESC_DONE and skbs ready to be freed
+ */
+#define VNET_CLEAN_TIMEOUT              ((HZ/100)+1)
+
+#define VNET_MAXPACKET                  (65535ULL + ETH_HLEN + VLAN_HLEN)
 #define VNET_TX_RING_SIZE               512
 #define VNET_TX_WAKEUP_THRESH(dr)       ((dr)->pending / 4)
 
@@ -20,10 +26,12 @@
  */
 #define VNET_PACKET_SKIP                6
 
+#define VNET_MAXCOOKIES                 (VNET_MAXPACKET/PAGE_SIZE + 1)
+
 struct vnet_tx_entry {
-        void                    *buf;
+        struct sk_buff          *skb;
         unsigned int            ncookies;
-        struct ldc_trans_cookie cookies[2];
+        struct ldc_trans_cookie cookies[VNET_MAXCOOKIES];
 };
 
 struct vnet;
@@ -44,6 +52,10 @@ struct vnet_port {
         u32                     stop_rx_idx;
         bool                    stop_rx;
         bool                    start_cons;
+
+        struct timer_list       clean_timer;
+
+        u64                     rmtu;
 };
 
 static inline struct vnet_port *to_vnet_port(struct vio_driver_state *vio)