12 files changed, 54 insertions, 28 deletions

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 7aee46983be4..99389c8dda21 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1934,7 +1934,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
         }
 
         if (bp->port.pmf)
-                bnx2x_update_drv_flags(bp, DRV_FLAGS_DCB_CONFIGURED, 0);
+                bnx2x_update_drv_flags(bp, 1 << DRV_FLAGS_DCB_CONFIGURED, 0);
         else
                 bnx2x__link_status_update(bp);
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index bf27c54ff2e0..4f40f7d7d8c6 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -1179,10 +1179,16 @@ static inline int bnx2x_alloc_rx_bds(struct bnx2x_fastpath *fp,
  */
 static inline u8 bnx2x_stats_id(struct bnx2x_fastpath *fp)
 {
-        if (!CHIP_IS_E1x(fp->bp))
+        struct bnx2x *bp = fp->bp;
+        if (!CHIP_IS_E1x(bp)) {
+#ifdef BCM_CNIC
+                /* there are special statistics counters for FCoE 136..140 */
+                if (IS_FCOE_FP(fp))
+                        return bp->cnic_base_cl_id + (bp->pf_num >> 1);
+#endif
                 return fp->cl_id;
-        else
-                return fp->cl_id + BP_PORT(fp->bp) * FP_SB_MAX_E1x;
+        }
+        return fp->cl_id + BP_PORT(bp) * FP_SB_MAX_E1x;
 }
 
 static inline void bnx2x_init_vlan_mac_fp_objs(struct bnx2x_fastpath *fp,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
index 5051cf3deb20..6d82ade4c31c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
@@ -735,7 +735,9 @@ void bnx2x_dcbx_set_params(struct bnx2x *bp, u32 state)
                                                  bp->dcbx_error);
 
                         /* mark DCBX result for PMF migration */
-                        bnx2x_update_drv_flags(bp, DRV_FLAGS_DCB_CONFIGURED, 1);
+                        bnx2x_update_drv_flags(bp,
+                                               1 << DRV_FLAGS_DCB_CONFIGURED,
+                                               1);
 #ifdef BCM_DCBNL
                         /*
                          * Add new app tlvs to dcbnl
@@ -1020,7 +1022,7 @@ void bnx2x_dcbx_init(struct bnx2x *bp)
                 DP(NETIF_MSG_LINK, "dcbx_lldp_params_offset 0x%x\n",
                    dcbx_lldp_params_offset);
 
-                bnx2x_update_drv_flags(bp, DRV_FLAGS_DCB_CONFIGURED, 0);
+                bnx2x_update_drv_flags(bp, 1 << DRV_FLAGS_DCB_CONFIGURED, 0);
 
                 if (SHMEM_LLDP_DCBX_PARAMS_NONE != dcbx_lldp_params_offset) {
                         bnx2x_dcbx_admin_mib_updated_params(bp,
@@ -1857,7 +1859,7 @@ void bnx2x_dcbx_pmf_update(struct bnx2x *bp)
          * read it from shmem and update bp and netdev accordingly
          */
         if (SHMEM2_HAS(bp, drv_flags) &&
-           GET_FLAGS(SHMEM2_RD(bp, drv_flags), DRV_FLAGS_DCB_CONFIGURED)) {
+           GET_FLAGS(SHMEM2_RD(bp, drv_flags), 1 << DRV_FLAGS_DCB_CONFIGURED)) {
                 /* Read neg results if dcbx is in the FW */
                 if (bnx2x_dcbx_read_shmem_neg_results(bp))
                         return;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index cb6339c35571..94110e9ce51d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -5601,7 +5601,7 @@ static inline int bnx2x_func_send_start(struct bnx2x *bp,
 
         /* Fill the ramrod data with provided parameters */
         rdata->function_mode = cpu_to_le16(start_params->mf_mode);
-        rdata->sd_vlan_tag   = start_params->sd_vlan_tag;
+        rdata->sd_vlan_tag   = cpu_to_le16(start_params->sd_vlan_tag);
         rdata->path_id       = BP_PATH(bp);
         rdata->network_cos_mode = start_params->network_cos_mode;
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index 1adef266fcd5..a766b25eec5f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -554,23 +554,11 @@ static void bnx2x_bmac_stats_update(struct bnx2x *bp)
                 UPDATE_STAT64(tx_stat_gtufl, tx_stat_mac_ufl);
 
                 /* collect PFC stats */
-                DIFF_64(diff.hi, new->tx_stat_gtpp_hi,
-                        pstats->pfc_frames_tx_hi,
-                        diff.lo, new->tx_stat_gtpp_lo,
-                        pstats->pfc_frames_tx_lo);
                 pstats->pfc_frames_tx_hi = new->tx_stat_gtpp_hi;
                 pstats->pfc_frames_tx_lo = new->tx_stat_gtpp_lo;
-                ADD_64(pstats->pfc_frames_tx_hi, diff.hi,
-                        pstats->pfc_frames_tx_lo, diff.lo);
 
-                DIFF_64(diff.hi, new->rx_stat_grpp_hi,
-                        pstats->pfc_frames_rx_hi,
-                        diff.lo, new->rx_stat_grpp_lo,
-                        pstats->pfc_frames_rx_lo);
                 pstats->pfc_frames_rx_hi = new->rx_stat_grpp_hi;
                 pstats->pfc_frames_rx_lo = new->rx_stat_grpp_lo;
-                ADD_64(pstats->pfc_frames_rx_hi, diff.hi,
-                        pstats->pfc_frames_rx_lo, diff.lo);
         }
 
         estats->pause_frames_received_hi =
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 93c5d72711b0..2d7601dd6660 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -359,7 +359,7 @@ static void tun_free_netdev(struct net_device *dev)
 {
         struct tun_struct *tun = netdev_priv(dev);
 
-        sock_put(tun->socket.sk);
+        sk_release_kernel(tun->socket.sk);
 }
 
 /* Net device open. */
@@ -980,10 +980,18 @@ static int tun_recvmsg(struct kiocb *iocb, struct socket *sock,
         return ret;
 }
 
+static int tun_release(struct socket *sock)
+{
+        if (sock->sk)
+                sock_put(sock->sk);
+        return 0;
+}
+
 /* Ops structure to mimic raw sockets with tun */
 static const struct proto_ops tun_socket_ops = {
         .sendmsg = tun_sendmsg,
         .recvmsg = tun_recvmsg,
+        .release = tun_release,
 };
 
 static struct proto tun_proto = {
@@ -1110,10 +1118,11 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                 tun->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
 
                 err = -ENOMEM;
-                sk = sk_alloc(net, AF_UNSPEC, GFP_KERNEL, &tun_proto);
+                sk = sk_alloc(&init_net, AF_UNSPEC, GFP_KERNEL, &tun_proto);
                 if (!sk)
                         goto err_free_dev;
 
+                sk_change_net(sk, net);
                 tun->socket.wq = &tun->wq;
                 init_waitqueue_head(&tun->wq.wait);
                 tun->socket.ops = &tun_socket_ops;
@@ -1174,7 +1183,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
         return 0;
 
  err_free_sk:
-        sock_put(sk);
+        tun_free_netdev(dev);
  err_free_dev:
         free_netdev(dev);
  failed:
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index 8e84f5bdd6ca..d6da5eed5453 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1599,6 +1599,10 @@ static const struct usb_device_id	products [] = {
         USB_DEVICE (0x6189, 0x182d),
         .driver_info =  (unsigned long) &ax8817x_info,
 }, {
+        // Sitecom LN-031 "USB 2.0 10/100/1000 Ethernet adapter"
+        USB_DEVICE (0x0df6, 0x0056),
+        .driver_info =  (unsigned long) &ax88178_info,
+}, {
         // corega FEther USB2-TX
         USB_DEVICE (0x07aa, 0x0017),
         .driver_info =  (unsigned long) &ax8817x_info,
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index 54b2d391e91a..a7dfba8d164e 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -2475,7 +2475,7 @@ il3945_bg_alive_start(struct work_struct *data)
             container_of(data, struct il_priv, alive_start.work);
 
         mutex_lock(&il->mutex);
-        if (test_bit(S_EXIT_PENDING, &il->status))
+        if (test_bit(S_EXIT_PENDING, &il->status) || il->txq == NULL)
                 goto out;
 
         il3945_alive_start(il);
diff --git a/drivers/net/wireless/iwlegacy/3945.c b/drivers/net/wireless/iwlegacy/3945.c
index 1489b1573a6a..c80eb9b31551 100644
--- a/drivers/net/wireless/iwlegacy/3945.c
+++ b/drivers/net/wireless/iwlegacy/3945.c
@@ -1870,11 +1870,12 @@ il3945_bg_reg_txpower_periodic(struct work_struct *work)
         struct il_priv *il = container_of(work, struct il_priv,
                                           _3945.thermal_periodic.work);
 
-        if (test_bit(S_EXIT_PENDING, &il->status))
-                return;
-
         mutex_lock(&il->mutex);
+        if (test_bit(S_EXIT_PENDING, &il->status) || il->txq == NULL)
+                goto out;
+
         il3945_reg_txpower_periodic(il);
+out:
         mutex_unlock(&il->mutex);
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index d2a1ea98d0f2..fd356b7c0476 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -426,10 +426,14 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         /*
          * If the data queue was below the threshold before the txdone
          * handler we must make sure the packet queue in the mac80211 stack
-         * is reenabled when the txdone handler has finished.
+         * is reenabled when the txdone handler has finished. This has to be
+         * serialized with rt2x00mac_tx(), otherwise we can wake up queue
+         * before it was stopped.
          */
+        spin_lock_bh(&entry->queue->tx_lock);
         if (!rt2x00queue_threshold(entry->queue))
                 rt2x00queue_unpause_queue(entry->queue);
+        spin_unlock_bh(&entry->queue->tx_lock);
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_txdone);
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index ede3c58e6783..2df2eb6d3e06 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -152,13 +152,22 @@ void rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         if (unlikely(rt2x00queue_write_tx_frame(queue, skb, false)))
                 goto exit_fail;
 
+        /*
+         * Pausing queue has to be serialized with rt2x00lib_txdone(). Note
+         * we should not use spin_lock_bh variant as bottom halve was already
+         * disabled before ieee80211_xmit() call.
+         */
+        spin_lock(&queue->tx_lock);
         if (rt2x00queue_threshold(queue))
                 rt2x00queue_pause_queue(queue);
+        spin_unlock(&queue->tx_lock);
 
         return;
 
  exit_fail:
+        spin_lock(&queue->tx_lock);
         rt2x00queue_pause_queue(queue);
+        spin_unlock(&queue->tx_lock);
  exit_free_skb:
         ieee80211_free_txskb(hw, skb);
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 5adfb3eab9cd..9b1b2b7a7807 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -619,6 +619,9 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
         else if (test_bit(REQUIRE_DMA, &queue->rt2x00dev->cap_flags))
                 rt2x00queue_align_frame(skb);
 
+        /*
+         * That function must be called with bh disabled.
+         */
         spin_lock(&queue->tx_lock);
 
         if (unlikely(rt2x00queue_full(queue))) {