17 files changed, 175 insertions, 105 deletions

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 95a6ca7d9e51..d9f85464b362 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3077,7 +3077,7 @@ static int bond_open(struct net_device *bond_dev)
         if (bond_has_slaves(bond)) {
                 read_lock(&bond->curr_slave_lock);
                 bond_for_each_slave(bond, slave, iter) {
-                        if ((bond->params.mode == BOND_MODE_ACTIVEBACKUP)
+                        if (USES_PRIMARY(bond->params.mode)
                                 && (slave != bond->curr_active_slave)) {
                                 bond_set_slave_inactive_flags(slave,
                                                               BOND_SLAVE_NOTIFY_NOW);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index 05f4f5f52635..3448cc033ca5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -21,6 +21,7 @@
 #include <linux/pci.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/irq.h>
 
 #include "bnx2x.h"
 #include "bnx2x_sriov.h"
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index adf8acbddf56..0966bd04375f 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -34,7 +34,6 @@
 #include <linux/dma-mapping.h>
 #include <linux/pm.h>
 #include <linux/clk.h>
-#include <linux/version.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
diff --git a/drivers/net/ethernet/cadence/at91_ether.c b/drivers/net/ethernet/cadence/at91_ether.c
index ce75de9bae9e..4a79edaf3885 100644
--- a/drivers/net/ethernet/cadence/at91_ether.c
+++ b/drivers/net/ethernet/cadence/at91_ether.c
@@ -342,6 +342,9 @@ static int __init at91ether_probe(struct platform_device *pdev)
         }
         clk_enable(lp->pclk);
 
+        lp->hclk = ERR_PTR(-ENOENT);
+        lp->tx_clk = ERR_PTR(-ENOENT);
+
         /* Install the interrupt handler */
         dev->irq = platform_get_irq(pdev, 0);
         res = devm_request_irq(&pdev->dev, dev->irq, at91ether_interrupt, 0, dev->name, dev);
diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h
index e9f7c656ddda..e35c8e0202ad 100644
--- a/drivers/net/ethernet/cisco/enic/enic.h
+++ b/drivers/net/ethernet/cisco/enic/enic.h
@@ -29,6 +29,7 @@
 #include "vnic_stats.h"
 #include "vnic_nic.h"
 #include "vnic_rss.h"
+#include <linux/irq.h>
 
 #define DRV_NAME                "enic"
 #define DRV_DESCRIPTION         "Cisco VIC Ethernet NIC Driver"
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index f31bb5e9d8a9..7b52a88923ef 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -23,6 +23,7 @@
 #include <linux/ethtool.h>
 #include <linux/mii.h>
 #include <linux/timer.h>
+#include <linux/irq.h>
 
 #include <linux/vmalloc.h>
 
diff --git a/drivers/net/ethernet/samsung/Kconfig b/drivers/net/ethernet/samsung/Kconfig
index 7902341f2623..2360d8150777 100644
--- a/drivers/net/ethernet/samsung/Kconfig
+++ b/drivers/net/ethernet/samsung/Kconfig
@@ -3,14 +3,30 @@
 #
 
 config NET_VENDOR_SAMSUNG
-        bool "Samsung Ethernet device"
+        bool "Samsung Ethernet devices"
         default y
         ---help---
-          This is the driver for the SXGBE 10G Ethernet IP block found on Samsung
-          platforms.
+          If you have a network (Ethernet) chipset belonging to this class,
+          say Y.
+
+          Note that the answer to this question does not directly affect
+          the kernel: saying N will just case the configurator to skip all
+          the questions about Samsung chipsets. If you say Y, you will be asked
+          for your specific chipset/driver in the following questions.
 
 if NET_VENDOR_SAMSUNG
 
-source "drivers/net/ethernet/samsung/sxgbe/Kconfig"
+config SXGBE_ETH
+        tristate "Samsung 10G/2.5G/1G SXGBE Ethernet driver"
+        depends on HAS_IOMEM && HAS_DMA
+        select PHYLIB
+        select CRC32
+        select PTP_1588_CLOCK
+        ---help---
+          This is the driver for the SXGBE 10G Ethernet IP block found on
+          Samsung platforms.
+
+          To compile this driver as a module, choose M here: the module
+          will be called samsung-sxgbe.
 
 endif # NET_VENDOR_SAMSUNG
diff --git a/drivers/net/ethernet/samsung/sxgbe/Kconfig b/drivers/net/ethernet/samsung/sxgbe/Kconfig
deleted file mode 100644
index d79288c51d0a..000000000000
--- a/drivers/net/ethernet/samsung/sxgbe/Kconfig
+++ /dev/null
@@ -1,9 +0,0 @@
-config SXGBE_ETH
-        tristate "Samsung 10G/2.5G/1G SXGBE Ethernet driver"
-        depends on HAS_IOMEM && HAS_DMA
-        select PHYLIB
-        select CRC32
-        select PTP_1588_CLOCK
-        ---help---
-          This is the driver for the SXGBE 10G Ethernet IP block found on Samsung
-          platforms.
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c
index 28f89c41d0cd..4d989ff6c978 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c
@@ -9,7 +9,6 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-#include <linux/io.h>
 #include <linux/delay.h>
 #include <linux/export.h>
 #include <linux/io.h>
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
index a72688e8dc6c..27e8c824b204 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
@@ -2113,11 +2113,11 @@ struct sxgbe_priv_data *sxgbe_drv_probe(struct device *device,
         /* allocate memory resources for Descriptor rings */
         ret = txring_mem_alloc(priv);
         if (ret)
-                goto error_free_netdev;
+                goto error_free_hw;
 
         ret = rxring_mem_alloc(priv);
         if (ret)
-                goto error_free_netdev;
+                goto error_free_hw;
 
         ndev->netdev_ops = &sxgbe_netdev_ops;
 
@@ -2163,7 +2163,7 @@ struct sxgbe_priv_data *sxgbe_drv_probe(struct device *device,
         if (IS_ERR(priv->sxgbe_clk)) {
                 netdev_warn(ndev, "%s: warning: cannot get CSR clock\n",
                             __func__);
-                goto error_clk_get;
+                goto error_napi_del;
         }
 
         /* If a specific clk_csr value is passed from the platform
@@ -2182,24 +2182,27 @@ struct sxgbe_priv_data *sxgbe_drv_probe(struct device *device,
         if (ret < 0) {
                 netdev_dbg(ndev, "%s: MDIO bus (id: %d) registration failed\n",
                            __func__, priv->plat->bus_id);
-                goto error_mdio_register;
+                goto error_clk_put;
         }
 
         ret = register_netdev(ndev);
         if (ret) {
                 pr_err("%s: ERROR %i registering the device\n", __func__, ret);
-                goto error_netdev_register;
+                goto error_mdio_unregister;
         }
 
         sxgbe_check_ether_addr(priv);
 
         return priv;
 
-error_mdio_register:
+error_mdio_unregister:
+        sxgbe_mdio_unregister(ndev);
+error_clk_put:
         clk_put(priv->sxgbe_clk);
-error_clk_get:
-error_netdev_register:
+error_napi_del:
         netif_napi_del(&priv->napi);
+error_free_hw:
+        kfree(priv->hw);
 error_free_netdev:
         free_netdev(ndev);
 
@@ -2224,11 +2227,15 @@ int sxgbe_drv_remove(struct net_device *ndev)
         priv->hw->mac->enable_tx(priv->ioaddr, false);
         priv->hw->mac->enable_rx(priv->ioaddr, false);
 
-        netif_napi_del(&priv->napi);
+        unregister_netdev(ndev);
 
         sxgbe_mdio_unregister(ndev);
 
-        unregister_netdev(ndev);
+        clk_put(priv->sxgbe_clk);
+
+        netif_napi_del(&priv->napi);
+
+        kfree(priv->hw);
 
         free_netdev(ndev);
 
diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
index 66b05e62f70a..1c44e67c3067 100644
--- a/drivers/net/ethernet/smsc/smc911x.c
+++ b/drivers/net/ethernet/smsc/smc911x.c
@@ -1211,7 +1211,6 @@ static void
 smc911x_rx_dma_irq(int dma, void *data)
 {
         struct net_device *dev = (struct net_device *)data;
-        unsigned long ioaddr = dev->base_addr;
         struct smc911x_local *lp = netdev_priv(dev);
         struct sk_buff *skb = lp->current_rx_skb;
         unsigned long flags;
diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
index a3bbf59eaafd..243513980b51 100644
--- a/drivers/net/ethernet/ti/cpts.c
+++ b/drivers/net/ethernet/ti/cpts.c
@@ -26,6 +26,8 @@
 #include <linux/time.h>
 #include <linux/uaccess.h>
 #include <linux/workqueue.h>
+#include <linux/if_ether.h>
+#include <linux/if_vlan.h>
 
 #include "cpts.h"
 
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index 89417ac41083..430bb0db9bc4 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -852,7 +852,7 @@ at86rf212_set_csma_params(struct ieee802154_dev *dev, u8 min_be, u8 max_be,
         if (rc)
                 return rc;
 
-        return at86rf230_write_subreg(lp, SR_MAX_CSMA_RETRIES, max_be);
+        return at86rf230_write_subreg(lp, SR_MAX_CSMA_RETRIES, retries);
 }
 
 static int
diff --git a/drivers/net/phy/spi_ks8995.c b/drivers/net/phy/spi_ks8995.c
index 4cf5fb922e59..22b047f1fcdc 100644
--- a/drivers/net/phy/spi_ks8995.c
+++ b/drivers/net/phy/spi_ks8995.c
@@ -1,5 +1,5 @@
 /*
- * SPI driver for Micrel/Kendin KS8995M ethernet switch
+ * SPI driver for Micrel/Kendin KS8995M and KSZ8864RMN ethernet switches
  *
  * Copyright (C) 2008 Gabor Juhos <juhosg at openwrt.org>
  *
@@ -70,7 +70,10 @@
 #define KS8995_REG_IAD1         0x76    /* Indirect Access Data 1 */
 #define KS8995_REG_IAD0         0x77    /* Indirect Access Data 0 */
 
+#define KSZ8864_REG_ID1         0xfe    /* Chip ID in bit 7 */
+
 #define KS8995_REGS_SIZE        0x80
+#define KSZ8864_REGS_SIZE       0x100
 
 #define ID1_CHIPID_M            0xf
 #define ID1_CHIPID_S            4
@@ -94,6 +97,7 @@ struct ks8995_switch {
         struct spi_device       *spi;
         struct mutex            lock;
         struct ks8995_pdata     *pdata;
+        struct bin_attribute    regs_attr;
 };
 
 static inline u8 get_chip_id(u8 val)
@@ -216,11 +220,11 @@ static ssize_t ks8995_registers_read(struct file *filp, struct kobject *kobj,
         dev = container_of(kobj, struct device, kobj);
         ks8995 = dev_get_drvdata(dev);
 
-        if (unlikely(off > KS8995_REGS_SIZE))
+        if (unlikely(off > ks8995->regs_attr.size))
                 return 0;
 
-        if ((off + count) > KS8995_REGS_SIZE)
-                count = KS8995_REGS_SIZE - off;
+        if ((off + count) > ks8995->regs_attr.size)
+                count = ks8995->regs_attr.size - off;
 
         if (unlikely(!count))
                 return count;
@@ -238,11 +242,11 @@ static ssize_t ks8995_registers_write(struct file *filp, struct kobject *kobj,
         dev = container_of(kobj, struct device, kobj);
         ks8995 = dev_get_drvdata(dev);
 
-        if (unlikely(off >= KS8995_REGS_SIZE))
+        if (unlikely(off >= ks8995->regs_attr.size))
                 return -EFBIG;
 
-        if ((off + count) > KS8995_REGS_SIZE)
-                count = KS8995_REGS_SIZE - off;
+        if ((off + count) > ks8995->regs_attr.size)
+                count = ks8995->regs_attr.size - off;
 
         if (unlikely(!count))
                 return count;
@@ -251,7 +255,7 @@ static ssize_t ks8995_registers_write(struct file *filp, struct kobject *kobj,
 }
 
 
-static struct bin_attribute ks8995_registers_attr = {
+static const struct bin_attribute ks8995_registers_attr = {
         .attr = {
                 .name   = "registers",
                 .mode   = S_IRUSR | S_IWUSR,
@@ -306,20 +310,44 @@ static int ks8995_probe(struct spi_device *spi)
                 goto err_drvdata;
         }
 
+        memcpy(&ks->regs_attr, &ks8995_registers_attr, sizeof(ks->regs_attr));
+        if (get_chip_id(ids[1]) != CHIPID_M) {
+                u8 val;
+
+                /* Check if this is a KSZ8864RMN */
+                err = ks8995_read(ks, &val, KSZ8864_REG_ID1, sizeof(val));
+                if (err < 0) {
+                        dev_err(&spi->dev,
+                                "unable to read chip id register, err=%d\n",
+                                err);
+                        goto err_drvdata;
+                }
+                if ((val & 0x80) == 0) {
+                        dev_err(&spi->dev, "unknown chip:%02x,0\n", ids[1]);
+                        goto err_drvdata;
+                }
+                ks->regs_attr.size = KSZ8864_REGS_SIZE;
+        }
+
         err = ks8995_reset(ks);
         if (err)
                 goto err_drvdata;
 
-        err = sysfs_create_bin_file(&spi->dev.kobj, &ks8995_registers_attr);
+        err = sysfs_create_bin_file(&spi->dev.kobj, &ks->regs_attr);
         if (err) {
                 dev_err(&spi->dev, "unable to create sysfs file, err=%d\n",
                                     err);
                 goto err_drvdata;
         }
 
-        dev_info(&spi->dev, "KS89%02X device found, Chip ID:%01x, "
-                        "Revision:%01x\n", ids[0],
-                        get_chip_id(ids[1]), get_chip_rev(ids[1]));
+        if (get_chip_id(ids[1]) == CHIPID_M) {
+                dev_info(&spi->dev,
+                         "KS8995 device found, Chip ID:%x, Revision:%x\n",
+                         get_chip_id(ids[1]), get_chip_rev(ids[1]));
+        } else {
+                dev_info(&spi->dev, "KSZ8864 device found, Revision:%x\n",
+                         get_chip_rev(ids[1]));
+        }
 
         return 0;
 
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 0d862a5077ab..c55e316373a1 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -871,6 +871,9 @@ static int vxlan_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
         if (err)
                 return err;
 
+        if (vxlan->default_dst.remote_ip.sa.sa_family != ip.sa.sa_family)
+                return -EAFNOSUPPORT;
+
         spin_lock_bh(&vxlan->hash_lock);
         err = vxlan_fdb_create(vxlan, addr, &ip, ndm->ndm_state, flags,
                                port, vni, ifindex, ndm->ndm_flags);
@@ -2601,9 +2604,10 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
         vni = nla_get_u32(data[IFLA_VXLAN_ID]);
         dst->remote_vni = vni;
 
+        /* Unless IPv6 is explicitly requested, assume IPv4 */
+        dst->remote_ip.sa.sa_family = AF_INET;
         if (data[IFLA_VXLAN_GROUP]) {
                 dst->remote_ip.sin.sin_addr.s_addr = nla_get_be32(data[IFLA_VXLAN_GROUP]);
-                dst->remote_ip.sa.sa_family = AF_INET;
         } else if (data[IFLA_VXLAN_GROUP6]) {
                 if (!IS_ENABLED(CONFIG_IPV6))
                         return -EPFNOSUPPORT;
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 89d1d0556b6e..630a3fcf65bc 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -124,6 +124,7 @@ struct xenvif {
         struct pending_tx_info pending_tx_info[MAX_PENDING_REQS];
         grant_handle_t grant_tx_handle[MAX_PENDING_REQS];
 
+        struct gnttab_copy tx_copy_ops[MAX_PENDING_REQS];
         struct gnttab_map_grant_ref tx_map_ops[MAX_PENDING_REQS];
         struct gnttab_unmap_grant_ref tx_unmap_ops[MAX_PENDING_REQS];
         /* passed to gnttab_[un]map_refs with pages under (un)mapping */
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 3f021e054ba1..76665405c5aa 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -820,13 +820,13 @@ struct xenvif_tx_cb {
 
 #define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb)
 
-static inline void xenvif_tx_create_gop(struct xenvif *vif,
-                                        u16 pending_idx,
-                                        struct xen_netif_tx_request *txp,
-                                        struct gnttab_map_grant_ref *gop)
+static inline void xenvif_tx_create_map_op(struct xenvif *vif,
+                                          u16 pending_idx,
+                                          struct xen_netif_tx_request *txp,
+                                          struct gnttab_map_grant_ref *mop)
 {
-        vif->pages_to_map[gop-vif->tx_map_ops] = vif->mmap_pages[pending_idx];
-        gnttab_set_map_op(gop, idx_to_kaddr(vif, pending_idx),
+        vif->pages_to_map[mop-vif->tx_map_ops] = vif->mmap_pages[pending_idx];
+        gnttab_set_map_op(mop, idx_to_kaddr(vif, pending_idx),
                           GNTMAP_host_map | GNTMAP_readonly,
                           txp->gref, vif->domid);
 
@@ -880,7 +880,7 @@ static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif *vif,
              shinfo->nr_frags++, txp++, gop++) {
                 index = pending_index(vif->pending_cons++);
                 pending_idx = vif->pending_ring[index];
-                xenvif_tx_create_gop(vif, pending_idx, txp, gop);
+                xenvif_tx_create_map_op(vif, pending_idx, txp, gop);
                 frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx);
         }
 
@@ -900,7 +900,7 @@ static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif *vif,
                      shinfo->nr_frags++, txp++, gop++) {
                         index = pending_index(vif->pending_cons++);
                         pending_idx = vif->pending_ring[index];
-                        xenvif_tx_create_gop(vif, pending_idx, txp, gop);
+                        xenvif_tx_create_map_op(vif, pending_idx, txp, gop);
                         frag_set_pending_idx(&frags[shinfo->nr_frags],
                                              pending_idx);
                 }
@@ -940,38 +940,42 @@ static inline void xenvif_grant_handle_reset(struct xenvif *vif,
 
 static int xenvif_tx_check_gop(struct xenvif *vif,
                                struct sk_buff *skb,
-                               struct gnttab_map_grant_ref **gopp)
+                               struct gnttab_map_grant_ref **gopp_map,
+                               struct gnttab_copy **gopp_copy)
 {
-        struct gnttab_map_grant_ref *gop = *gopp;
+        struct gnttab_map_grant_ref *gop_map = *gopp_map;
         u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
         struct skb_shared_info *shinfo = skb_shinfo(skb);
-        struct pending_tx_info *tx_info;
         int nr_frags = shinfo->nr_frags;
-        int i, err, start;
+        int i, err;
         struct sk_buff *first_skb = NULL;
 
         /* Check status of header. */
-        err = gop->status;
-        if (unlikely(err))
+        err = (*gopp_copy)->status;
+        (*gopp_copy)++;
+        if (unlikely(err)) {
+                if (net_ratelimit())
+                        netdev_dbg(vif->dev,
+                                   "Grant copy of header failed! status: %d pending_idx: %u ref: %u\n",
+                                   (*gopp_copy)->status,
+                                   pending_idx,
+                                   (*gopp_copy)->source.u.ref);
                 xenvif_idx_release(vif, pending_idx, XEN_NETIF_RSP_ERROR);
-        else
-                xenvif_grant_handle_set(vif, pending_idx , gop->handle);
-
-        /* Skip first skb fragment if it is on same page as header fragment. */
-        start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);
+        }
 
 check_frags:
-        for (i = start; i < nr_frags; i++) {
+        for (i = 0; i < nr_frags; i++, gop_map++) {
                 int j, newerr;
 
                 pending_idx = frag_get_pending_idx(&shinfo->frags[i]);
-                tx_info = &vif->pending_tx_info[pending_idx];
 
                 /* Check error status: if okay then remember grant handle. */
-                newerr = (++gop)->status;
+                newerr = gop_map->status;
 
                 if (likely(!newerr)) {
-                        xenvif_grant_handle_set(vif, pending_idx , gop->handle);
+                        xenvif_grant_handle_set(vif,
+                                                pending_idx,
+                                                gop_map->handle);
                         /* Had a previous error? Invalidate this fragment. */
                         if (unlikely(err))
                                 xenvif_idx_unmap(vif, pending_idx);
@@ -979,18 +983,20 @@ check_frags:
                 }
 
                 /* Error on this fragment: respond to client with an error. */
+                if (net_ratelimit())
+                        netdev_dbg(vif->dev,
+                                   "Grant map of %d. frag failed! status: %d pending_idx: %u ref: %u\n",
+                                   i,
+                                   gop_map->status,
+                                   pending_idx,
+                                   gop_map->ref);
                 xenvif_idx_release(vif, pending_idx, XEN_NETIF_RSP_ERROR);
 
                 /* Not the first error? Preceding frags already invalidated. */
                 if (err)
                         continue;
-                /* First error: invalidate header and preceding fragments. */
-                if (!first_skb)
-                        pending_idx = XENVIF_TX_CB(skb)->pending_idx;
-                else
-                        pending_idx = XENVIF_TX_CB(skb)->pending_idx;
-                xenvif_idx_unmap(vif, pending_idx);
-                for (j = start; j < i; j++) {
+                /* First error: invalidate preceding fragments. */
+                for (j = 0; j < i; j++) {
                         pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
                         xenvif_idx_unmap(vif, pending_idx);
                 }
@@ -1004,7 +1010,6 @@ check_frags:
                 skb = shinfo->frag_list;
                 shinfo = skb_shinfo(skb);
                 nr_frags = shinfo->nr_frags;
-                start = 0;
 
                 goto check_frags;
         }
@@ -1015,15 +1020,13 @@ check_frags:
         if (first_skb && err) {
                 int j;
                 shinfo = skb_shinfo(first_skb);
-                pending_idx = XENVIF_TX_CB(skb)->pending_idx;
-                start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);
-                for (j = start; j < shinfo->nr_frags; j++) {
+                for (j = 0; j < shinfo->nr_frags; j++) {
                         pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
                         xenvif_idx_unmap(vif, pending_idx);
                 }
         }
 
-        *gopp = gop + 1;
+        *gopp_map = gop_map;
         return err;
 }
 
@@ -1034,9 +1037,6 @@ static void xenvif_fill_frags(struct xenvif *vif, struct sk_buff *skb)
         int i;
         u16 prev_pending_idx = INVALID_PENDING_IDX;
 
-        if (skb_shinfo(skb)->destructor_arg)
-                prev_pending_idx = XENVIF_TX_CB(skb)->pending_idx;
-
         for (i = 0; i < nr_frags; i++) {
                 skb_frag_t *frag = shinfo->frags + i;
                 struct xen_netif_tx_request *txp;
@@ -1046,10 +1046,10 @@ static void xenvif_fill_frags(struct xenvif *vif, struct sk_buff *skb)
                 pending_idx = frag_get_pending_idx(frag);
 
                 /* If this is not the first frag, chain it to the previous*/
-                if (unlikely(prev_pending_idx == INVALID_PENDING_IDX))
+                if (prev_pending_idx == INVALID_PENDING_IDX)
                         skb_shinfo(skb)->destructor_arg =
                                 &callback_param(vif, pending_idx);
-                else if (likely(pending_idx != prev_pending_idx))
+                else
                         callback_param(vif, prev_pending_idx).ctx =
                                 &callback_param(vif, pending_idx);
 
@@ -1189,7 +1189,10 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
         return false;
 }
 
-static unsigned xenvif_tx_build_gops(struct xenvif *vif, int budget)
+static void xenvif_tx_build_gops(struct xenvif *vif,
+                                     int budget,
+                                     unsigned *copy_ops,
+                                     unsigned *map_ops)
 {
         struct gnttab_map_grant_ref *gop = vif->tx_map_ops, *request_gop;
         struct sk_buff *skb;
@@ -1292,22 +1295,36 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif, int budget)
                         }
                 }
 
-                xenvif_tx_create_gop(vif, pending_idx, &txreq, gop);
-
-                gop++;
-
                 XENVIF_TX_CB(skb)->pending_idx = pending_idx;
 
                 __skb_put(skb, data_len);
+                vif->tx_copy_ops[*copy_ops].source.u.ref = txreq.gref;
+                vif->tx_copy_ops[*copy_ops].source.domid = vif->domid;
+                vif->tx_copy_ops[*copy_ops].source.offset = txreq.offset;
+
+                vif->tx_copy_ops[*copy_ops].dest.u.gmfn =
+                        virt_to_mfn(skb->data);
+                vif->tx_copy_ops[*copy_ops].dest.domid = DOMID_SELF;
+                vif->tx_copy_ops[*copy_ops].dest.offset =
+                        offset_in_page(skb->data);
+
+                vif->tx_copy_ops[*copy_ops].len = data_len;
+                vif->tx_copy_ops[*copy_ops].flags = GNTCOPY_source_gref;
+
+                (*copy_ops)++;
 
                 skb_shinfo(skb)->nr_frags = ret;
                 if (data_len < txreq.size) {
                         skb_shinfo(skb)->nr_frags++;
                         frag_set_pending_idx(&skb_shinfo(skb)->frags[0],
                                              pending_idx);
+                        xenvif_tx_create_map_op(vif, pending_idx, &txreq, gop);
+                        gop++;
                 } else {
                         frag_set_pending_idx(&skb_shinfo(skb)->frags[0],
                                              INVALID_PENDING_IDX);
+                        memcpy(&vif->pending_tx_info[pending_idx].req, &txreq,
+                               sizeof(txreq));
                 }
 
                 vif->pending_cons++;
@@ -1324,11 +1341,13 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif, int budget)
 
                 vif->tx.req_cons = idx;
 
-                if ((gop-vif->tx_map_ops) >= ARRAY_SIZE(vif->tx_map_ops))
+                if (((gop-vif->tx_map_ops) >= ARRAY_SIZE(vif->tx_map_ops)) ||
+                    (*copy_ops >= ARRAY_SIZE(vif->tx_copy_ops)))
                         break;
         }
 
-        return gop - vif->tx_map_ops;
+        (*map_ops) = gop - vif->tx_map_ops;
+        return;
 }
 
 /* Consolidate skb with a frag_list into a brand new one with local pages on
@@ -1399,7 +1418,8 @@ static int xenvif_handle_frag_list(struct xenvif *vif, struct sk_buff *skb)
 
 static int xenvif_tx_submit(struct xenvif *vif)
 {
-        struct gnttab_map_grant_ref *gop = vif->tx_map_ops;
+        struct gnttab_map_grant_ref *gop_map = vif->tx_map_ops;
+        struct gnttab_copy *gop_copy = vif->tx_copy_ops;
         struct sk_buff *skb;
         int work_done = 0;
 
@@ -1412,27 +1432,22 @@ static int xenvif_tx_submit(struct xenvif *vif)
                 txp = &vif->pending_tx_info[pending_idx].req;
 
                 /* Check the remap error code. */
-                if (unlikely(xenvif_tx_check_gop(vif, skb, &gop))) {
-                        netdev_dbg(vif->dev, "netback grant failed.\n");
+                if (unlikely(xenvif_tx_check_gop(vif, skb, &gop_map, &gop_copy))) {
                         skb_shinfo(skb)->nr_frags = 0;
                         kfree_skb(skb);
                         continue;
                 }
 
                 data_len = skb->len;
-                memcpy(skb->data,
-                       (void *)(idx_to_kaddr(vif, pending_idx)|txp->offset),
-                       data_len);
                 callback_param(vif, pending_idx).ctx = NULL;
                 if (data_len < txp->size) {
                         /* Append the packet payload as a fragment. */
                         txp->offset += data_len;
                         txp->size -= data_len;
-                        skb_shinfo(skb)->destructor_arg =
-                                &callback_param(vif, pending_idx);
                 } else {
                         /* Schedule a response immediately. */
-                        xenvif_idx_unmap(vif, pending_idx);
+                        xenvif_idx_release(vif, pending_idx,
+                                           XEN_NETIF_RSP_OKAY);
                 }
 
                 if (txp->flags & XEN_NETTXF_csum_blank)
@@ -1611,22 +1626,25 @@ static inline void xenvif_tx_dealloc_action(struct xenvif *vif)
 /* Called after netfront has transmitted */
 int xenvif_tx_action(struct xenvif *vif, int budget)
 {
-        unsigned nr_gops;
+        unsigned nr_mops, nr_cops = 0;
         int work_done, ret;
 
         if (unlikely(!tx_work_todo(vif)))
                 return 0;
 
-        nr_gops = xenvif_tx_build_gops(vif, budget);
+        xenvif_tx_build_gops(vif, budget, &nr_cops, &nr_mops);
 
-        if (nr_gops == 0)
+        if (nr_cops == 0)
                 return 0;
 
-        ret = gnttab_map_refs(vif->tx_map_ops,
-                              NULL,
-                              vif->pages_to_map,
-                              nr_gops);
-        BUG_ON(ret);
+        gnttab_batch_copy(vif->tx_copy_ops, nr_cops);
+        if (nr_mops != 0) {
+                ret = gnttab_map_refs(vif->tx_map_ops,
+                                      NULL,
+                                      vif->pages_to_map,
+                                      nr_mops);
+                BUG_ON(ret);
+        }
 
         work_done = xenvif_tx_submit(vif);