14 files changed, 94 insertions, 76 deletions

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index a3b0f7a0c61e..1f82a04ce01a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1774,7 +1774,7 @@ struct bnx2x {
         int                     stats_state;
 
         /* used for synchronization of concurrent threads statistics handling */
-        struct mutex            stats_lock;
+        struct semaphore        stats_lock;
 
         /* used by dmae command loader */
         struct dmae_command     stats_dmae;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index fd52ce95127e..33501bcddc48 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12054,7 +12054,7 @@ static int bnx2x_init_bp(struct bnx2x *bp)
         mutex_init(&bp->port.phy_mutex);
         mutex_init(&bp->fw_mb_mutex);
         mutex_init(&bp->drv_info_mutex);
-        mutex_init(&bp->stats_lock);
+        sema_init(&bp->stats_lock, 1);
         bp->drv_info_mng_owner = false;
 
         INIT_DELAYED_WORK(&bp->sp_task, bnx2x_sp_task);
@@ -13690,9 +13690,10 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp)
         cancel_delayed_work_sync(&bp->sp_task);
         cancel_delayed_work_sync(&bp->period_task);
 
-        mutex_lock(&bp->stats_lock);
-        bp->stats_state = STATS_STATE_DISABLED;
-        mutex_unlock(&bp->stats_lock);
+        if (!down_timeout(&bp->stats_lock, HZ / 10)) {
+                bp->stats_state = STATS_STATE_DISABLED;
+                up(&bp->stats_lock);
+        }
 
         bnx2x_save_statistics(bp);
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index 266b055c2360..69d699f0730a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -1372,19 +1372,23 @@ void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event)
          * that context in case someone is in the middle of a transition.
          * For other events, wait a bit until lock is taken.
          */
-        if (!mutex_trylock(&bp->stats_lock)) {
+        if (down_trylock(&bp->stats_lock)) {
                 if (event == STATS_EVENT_UPDATE)
                         return;
 
                 DP(BNX2X_MSG_STATS,
                    "Unlikely stats' lock contention [event %d]\n", event);
-                mutex_lock(&bp->stats_lock);
+                if (unlikely(down_timeout(&bp->stats_lock, HZ / 10))) {
+                        BNX2X_ERR("Failed to take stats lock [event %d]\n",
+                                  event);
+                        return;
+                }
         }
 
         bnx2x_stats_stm[state][event].action(bp);
         bp->stats_state = bnx2x_stats_stm[state][event].next_state;
 
-        mutex_unlock(&bp->stats_lock);
+        up(&bp->stats_lock);
 
         if ((event != STATS_EVENT_UPDATE) || netif_msg_timer(bp))
                 DP(BNX2X_MSG_STATS, "state %d -> event %d -> state %d\n",
@@ -1970,7 +1974,11 @@ int bnx2x_stats_safe_exec(struct bnx2x *bp,
         /* Wait for statistics to end [while blocking further requests],
          * then run supplied function 'safely'.
          */
-        mutex_lock(&bp->stats_lock);
+        rc = down_timeout(&bp->stats_lock, HZ / 10);
+        if (unlikely(rc)) {
+                BNX2X_ERR("Failed to take statistics lock for safe execution\n");
+                goto out_no_lock;
+        }
 
         bnx2x_stats_comp(bp);
         while (bp->stats_pending && cnt--)
@@ -1988,7 +1996,7 @@ out:
         /* No need to restart statistics - if they're enabled, the timer
          * will restart the statistics.
          */
-        mutex_unlock(&bp->stats_lock);
-
+        up(&bp->stats_lock);
+out_no_lock:
         return rc;
 }
diff --git a/drivers/net/ethernet/brocade/bna/bfa_ioc.c b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
index 594a2ab36d31..68f3c13c9ef6 100644
--- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c
+++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
@@ -2414,7 +2414,7 @@ bfa_ioc_boot(struct bfa_ioc *ioc, enum bfi_fwboot_type boot_type,
         if (status == BFA_STATUS_OK)
                 bfa_ioc_lpu_start(ioc);
         else
-                bfa_nw_iocpf_timeout(ioc);
+                bfa_fsm_send_event(&ioc->iocpf, IOCPF_E_TIMEOUT);
 
         return status;
 }
@@ -3029,7 +3029,7 @@ bfa_ioc_poll_fwinit(struct bfa_ioc *ioc)
         }
 
         if (ioc->iocpf.poll_time >= BFA_IOC_TOV) {
-                bfa_nw_iocpf_timeout(ioc);
+                bfa_fsm_send_event(&ioc->iocpf, IOCPF_E_TIMEOUT);
         } else {
                 ioc->iocpf.poll_time += BFA_IOC_POLL_TOV;
                 mod_timer(&ioc->iocpf_timer, jiffies +
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index 37072a83f9d6..caae6cb2bc1a 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -3701,10 +3701,6 @@ bnad_pci_probe(struct pci_dev *pdev,
         setup_timer(&bnad->bna.ioceth.ioc.sem_timer, bnad_iocpf_sem_timeout,
                                 ((unsigned long)bnad));
 
-        /* Now start the timer before calling IOC */
-        mod_timer(&bnad->bna.ioceth.ioc.iocpf_timer,
-                  jiffies + msecs_to_jiffies(BNA_IOC_TIMER_FREQ));
-
         /*
          * Start the chip
          * If the call back comes with error, we bail out.
diff --git a/drivers/net/ethernet/brocade/bna/cna_fwimg.c b/drivers/net/ethernet/brocade/bna/cna_fwimg.c
index ebf462d8082f..badea368bdc8 100644
--- a/drivers/net/ethernet/brocade/bna/cna_fwimg.c
+++ b/drivers/net/ethernet/brocade/bna/cna_fwimg.c
@@ -30,6 +30,7 @@ cna_read_firmware(struct pci_dev *pdev, u32 **bfi_image,
                         u32 *bfi_image_size, char *fw_name)
 {
         const struct firmware *fw;
+        u32 n;
 
         if (request_firmware(&fw, fw_name, &pdev->dev)) {
                 pr_alert("Can't locate firmware %s\n", fw_name);
@@ -40,6 +41,12 @@ cna_read_firmware(struct pci_dev *pdev, u32 **bfi_image,
         *bfi_image_size = fw->size/sizeof(u32);
         bfi_fw = fw;
 
+        /* Convert loaded firmware to host order as it is stored in file
+         * as sequence of LE32 integers.
+         */
+        for (n = 0; n < *bfi_image_size; n++)
+                le32_to_cpus(*bfi_image + n);
+
         return *bfi_image;
 error:
         return NULL;
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index c0ad95d2f63d..809ea4610a77 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -224,12 +224,17 @@ static void efx_unmap_rx_buffer(struct efx_nic *efx,
         }
 }
 
-static void efx_free_rx_buffer(struct efx_rx_buffer *rx_buf)
+static void efx_free_rx_buffers(struct efx_rx_queue *rx_queue,
+                                struct efx_rx_buffer *rx_buf,
+                                unsigned int num_bufs)
 {
-        if (rx_buf->page) {
-                put_page(rx_buf->page);
-                rx_buf->page = NULL;
-        }
+        do {
+                if (rx_buf->page) {
+                        put_page(rx_buf->page);
+                        rx_buf->page = NULL;
+                }
+                rx_buf = efx_rx_buf_next(rx_queue, rx_buf);
+        } while (--num_bufs);
 }
 
 /* Attempt to recycle the page if there is an RX recycle ring; the page can
@@ -278,7 +283,7 @@ static void efx_fini_rx_buffer(struct efx_rx_queue *rx_queue,
         /* If this is the last buffer in a page, unmap and free it. */
         if (rx_buf->flags & EFX_RX_BUF_LAST_IN_PAGE) {
                 efx_unmap_rx_buffer(rx_queue->efx, rx_buf);
-                efx_free_rx_buffer(rx_buf);
+                efx_free_rx_buffers(rx_queue, rx_buf, 1);
         }
         rx_buf->page = NULL;
 }
@@ -304,10 +309,7 @@ static void efx_discard_rx_packet(struct efx_channel *channel,
 
         efx_recycle_rx_pages(channel, rx_buf, n_frags);
 
-        do {
-                efx_free_rx_buffer(rx_buf);
-                rx_buf = efx_rx_buf_next(rx_queue, rx_buf);
-        } while (--n_frags);
+        efx_free_rx_buffers(rx_queue, rx_buf, n_frags);
 }
 
 /**
@@ -431,11 +433,10 @@ efx_rx_packet_gro(struct efx_channel *channel, struct efx_rx_buffer *rx_buf,
 
         skb = napi_get_frags(napi);
         if (unlikely(!skb)) {
-                while (n_frags--) {
-                        put_page(rx_buf->page);
-                        rx_buf->page = NULL;
-                        rx_buf = efx_rx_buf_next(&channel->rx_queue, rx_buf);
-                }
+                struct efx_rx_queue *rx_queue;
+
+                rx_queue = efx_channel_get_rx_queue(channel);
+                efx_free_rx_buffers(rx_queue, rx_buf, n_frags);
                 return;
         }
 
@@ -622,7 +623,10 @@ static void efx_rx_deliver(struct efx_channel *channel, u8 *eh,
 
         skb = efx_rx_mk_skb(channel, rx_buf, n_frags, eh, hdr_len);
         if (unlikely(skb == NULL)) {
-                efx_free_rx_buffer(rx_buf);
+                struct efx_rx_queue *rx_queue;
+
+                rx_queue = efx_channel_get_rx_queue(channel);
+                efx_free_rx_buffers(rx_queue, rx_buf, n_frags);
                 return;
         }
         skb_record_rx_queue(skb, channel->rx_queue.core_index);
@@ -661,8 +665,12 @@ void __efx_rx_packet(struct efx_channel *channel)
          * loopback layer, and free the rx_buf here
          */
         if (unlikely(efx->loopback_selftest)) {
+                struct efx_rx_queue *rx_queue;
+
                 efx_loopback_rx_packet(efx, eh, rx_buf->len);
-                efx_free_rx_buffer(rx_buf);
+                rx_queue = efx_channel_get_rx_queue(channel);
+                efx_free_rx_buffers(rx_queue, rx_buf,
+                                    channel->rx_pkt_n_frags);
                 goto out;
         }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index 4ec9811f49c8..65efb1468988 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -511,11 +511,9 @@ static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx,
                                      msgbuf->rx_pktids,
                                      msgbuf->ioctl_resp_pktid);
         if (msgbuf->ioctl_resp_ret_len != 0) {
-                if (!skb) {
-                        brcmf_err("Invalid packet id idx recv'd %d\n",
-                                  msgbuf->ioctl_resp_pktid);
+                if (!skb)
                         return -EBADF;
-                }
+
                 memcpy(buf, skb->data, (len < msgbuf->ioctl_resp_ret_len) ?
                                        len : msgbuf->ioctl_resp_ret_len);
         }
@@ -874,10 +872,8 @@ brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf)
         flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
                                      msgbuf->tx_pktids, idx);
-        if (!skb) {
-                brcmf_err("Invalid packet id idx recv'd %d\n", idx);
+        if (!skb)
                 return;
-        }
 
         set_bit(flowid, msgbuf->txstatus_done_map);
         commonring = msgbuf->flowrings[flowid];
@@ -1156,6 +1152,8 @@ brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf)
 
         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
                                      msgbuf->rx_pktids, idx);
+        if (!skb)
+                return;
 
         if (data_offset)
                 skb_pull(skb, data_offset);
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 75e96db6626b..8e604a3931ca 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -471,7 +471,7 @@ static int iwl_get_radio_cfg(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
         if (cfg->device_family != IWL_DEVICE_FAMILY_8000)
                 return le16_to_cpup(nvm_sw + RADIO_CFG);
 
-        return le32_to_cpup((__le32 *)(nvm_sw + RADIO_CFG_FAMILY_8000));
+        return le32_to_cpup((__le32 *)(phy_sku + RADIO_CFG_FAMILY_8000));
 
 }
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 01996c9d98a7..376b84e54ad7 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -1,7 +1,7 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2003 - 2015 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -320,7 +320,7 @@ struct iwl_trans_pcie {
 
         /*protect hw register */
         spinlock_t reg_lock;
-        bool cmd_in_flight;
+        bool cmd_hold_nic_awake;
         bool ref_cmd_in_flight;
 
         /* protect ref counter */
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index d6f6515fe663..dc179094e6a0 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1372,7 +1372,7 @@ static bool iwl_trans_pcie_grab_nic_access(struct iwl_trans *trans, bool silent,
 
         spin_lock_irqsave(&trans_pcie->reg_lock, *flags);
 
-        if (trans_pcie->cmd_in_flight)
+        if (trans_pcie->cmd_hold_nic_awake)
                 goto out;
 
         /* this bit wakes up the NIC */
@@ -1438,7 +1438,7 @@ static void iwl_trans_pcie_release_nic_access(struct iwl_trans *trans,
          */
         __acquire(&trans_pcie->reg_lock);
 
-        if (trans_pcie->cmd_in_flight)
+        if (trans_pcie->cmd_hold_nic_awake)
                 goto out;
 
         __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 06952aadfd7b..5ef8044c2ea3 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1039,18 +1039,14 @@ static int iwl_pcie_set_cmd_in_flight(struct iwl_trans *trans,
                 iwl_trans_pcie_ref(trans);
         }
 
-        if (trans_pcie->cmd_in_flight)
-                return 0;
-
-        trans_pcie->cmd_in_flight = true;
-
         /*
          * wake up the NIC to make sure that the firmware will see the host
          * command - we will let the NIC sleep once all the host commands
          * returned. This needs to be done only on NICs that have
          * apmg_wake_up_wa set.
          */
-        if (trans->cfg->base_params->apmg_wake_up_wa) {
+        if (trans->cfg->base_params->apmg_wake_up_wa &&
+            !trans_pcie->cmd_hold_nic_awake) {
                 __iwl_trans_pcie_set_bit(trans, CSR_GP_CNTRL,
                                          CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
                 if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
@@ -1064,10 +1060,10 @@ static int iwl_pcie_set_cmd_in_flight(struct iwl_trans *trans,
                 if (ret < 0) {
                         __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
                                         CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
-                        trans_pcie->cmd_in_flight = false;
                         IWL_ERR(trans, "Failed to wake NIC for hcmd\n");
                         return -EIO;
                 }
+                trans_pcie->cmd_hold_nic_awake = true;
         }
 
         return 0;
@@ -1085,15 +1081,14 @@ static int iwl_pcie_clear_cmd_in_flight(struct iwl_trans *trans)
                 iwl_trans_pcie_unref(trans);
         }
 
-        if (WARN_ON(!trans_pcie->cmd_in_flight))
-                return 0;
-
-        trans_pcie->cmd_in_flight = false;
+        if (trans->cfg->base_params->apmg_wake_up_wa) {
+                if (WARN_ON(!trans_pcie->cmd_hold_nic_awake))
+                        return 0;
 
-        if (trans->cfg->base_params->apmg_wake_up_wa)
+                trans_pcie->cmd_hold_nic_awake = false;
                 __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
-                                        CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
-
+                                           CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+        }
         return 0;
 }
 
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 4de46aa61d95..0d2594395ffb 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1250,7 +1250,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
                         netdev_err(queue->vif->dev,
                                    "txreq.offset: %x, size: %u, end: %lu\n",
                                    txreq.offset, txreq.size,
-                                   (txreq.offset&~PAGE_MASK) + txreq.size);
+                                   (unsigned long)(txreq.offset&~PAGE_MASK) + txreq.size);
                         xenvif_fatal_tx_err(queue->vif);
                         break;
                 }
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index fee02414529e..968787abf78d 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -34,6 +34,8 @@ struct backend_info {
         enum xenbus_state frontend_state;
         struct xenbus_watch hotplug_status_watch;
         u8 have_hotplug_status_watch:1;
+
+        const char *hotplug_script;
 };
 
 static int connect_rings(struct backend_info *be, struct xenvif_queue *queue);
@@ -238,6 +240,7 @@ static int netback_remove(struct xenbus_device *dev)
                 xenvif_free(be->vif);
                 be->vif = NULL;
         }
+        kfree(be->hotplug_script);
         kfree(be);
         dev_set_drvdata(&dev->dev, NULL);
         return 0;
@@ -255,6 +258,7 @@ static int netback_probe(struct xenbus_device *dev,
         struct xenbus_transaction xbt;
         int err;
         int sg;
+        const char *script;
         struct backend_info *be = kzalloc(sizeof(struct backend_info),
                                           GFP_KERNEL);
         if (!be) {
@@ -347,6 +351,15 @@ static int netback_probe(struct xenbus_device *dev,
         if (err)
                 pr_debug("Error writing multi-queue-max-queues\n");
 
+        script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL);
+        if (IS_ERR(script)) {
+                err = PTR_ERR(script);
+                xenbus_dev_fatal(dev, err, "reading script");
+                goto fail;
+        }
+
+        be->hotplug_script = script;
+
         err = xenbus_switch_state(dev, XenbusStateInitWait);
         if (err)
                 goto fail;
@@ -379,22 +392,14 @@ static int netback_uevent(struct xenbus_device *xdev,
                           struct kobj_uevent_env *env)
 {
         struct backend_info *be = dev_get_drvdata(&xdev->dev);
-        char *val;
 
-        val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL);
-        if (IS_ERR(val)) {
-                int err = PTR_ERR(val);
-                xenbus_dev_fatal(xdev, err, "reading script");
-                return err;
-        } else {
-                if (add_uevent_var(env, "script=%s", val)) {
-                        kfree(val);
-                        return -ENOMEM;
-                }
-                kfree(val);
-        }
+        if (!be)
+                return 0;
+
+        if (add_uevent_var(env, "script=%s", be->hotplug_script))
+                return -ENOMEM;
 
-        if (!be || !be->vif)
+        if (!be->vif)
                 return 0;
 
         return add_uevent_var(env, "vif=%s", be->vif->dev->name);