firewire: fw-sbp2: fix NULL pointer deref. in scsi_remove_device
[safe/jmp/linux-2.6] / drivers / net / s2io.c
index 644d71b..6179a0a 100644 (file)
@@ -84,7 +84,7 @@
 #include "s2io.h"
 #include "s2io-regs.h"
 
-#define DRV_VERSION "2.0.26.17"
+#define DRV_VERSION "2.0.26.15-2"
 
 /* S2io Driver name & version. */
 static char s2io_driver_name[] = "Neterion";
@@ -368,12 +368,19 @@ static void do_s2io_copy_mac_addr(struct s2io_nic *sp, int offset, u64 mac_addr)
 static void s2io_vlan_rx_register(struct net_device *dev,
                                        struct vlan_group *grp)
 {
+       int i;
        struct s2io_nic *nic = dev->priv;
-       unsigned long flags;
+       unsigned long flags[MAX_TX_FIFOS];
+       struct mac_info *mac_control = &nic->mac_control;
+       struct config_param *config = &nic->config;
+
+       for (i = 0; i < config->tx_fifo_num; i++)
+               spin_lock_irqsave(&mac_control->fifos[i].tx_lock, flags[i]);
 
-       spin_lock_irqsave(&nic->tx_lock, flags);
        nic->vlgrp = grp;
-       spin_unlock_irqrestore(&nic->tx_lock, flags);
+       for (i = config->tx_fifo_num - 1; i >= 0; i--)
+               spin_unlock_irqrestore(&mac_control->fifos[i].tx_lock,
+                               flags[i]);
 }
 
 /* A flag indicating whether 'RX_PA_CFG_STRIP_VLAN_TAG' bit is set or not */
@@ -565,6 +572,21 @@ static int init_shared_mem(struct s2io_nic *nic)
                return -EINVAL;
        }
 
+       size = 0;
+       for (i = 0; i < config->tx_fifo_num; i++) {
+               size = config->tx_cfg[i].fifo_len;
+               /*
+                * Legal values are from 2 to 8192
+                */
+               if (size < 2) {
+                       DBG_PRINT(ERR_DBG, "s2io: Invalid fifo len (%d)", size);
+                       DBG_PRINT(ERR_DBG, "for fifo %d\n", i);
+                       DBG_PRINT(ERR_DBG, "s2io: Legal values for fifo len"
+                               "are 2 to 8192\n");
+                       return -EINVAL;
+               }
+       }
+
        lst_size = (sizeof(struct TxD) * config->max_txds);
        lst_per_page = PAGE_SIZE / lst_size;
 
@@ -639,10 +661,14 @@ static int init_shared_mem(struct s2io_nic *nic)
                }
        }
 
-       nic->ufo_in_band_v = kcalloc(size, sizeof(u64), GFP_KERNEL);
-       if (!nic->ufo_in_band_v)
-               return -ENOMEM;
-        mem_allocated += (size * sizeof(u64));
+       for (i = 0; i < config->tx_fifo_num; i++) {
+               size = config->tx_cfg[i].fifo_len;
+               mac_control->fifos[i].ufo_in_band_v
+                       = kcalloc(size, sizeof(u64), GFP_KERNEL);
+               if (!mac_control->fifos[i].ufo_in_band_v)
+                       return -ENOMEM;
+               mem_allocated += (size * sizeof(u64));
+       }
 
        /* Allocation and initialization of RXDs in Rings */
        size = 0;
@@ -829,7 +855,6 @@ static int init_shared_mem(struct s2io_nic *nic)
 static void free_shared_mem(struct s2io_nic *nic)
 {
        int i, j, blk_cnt, size;
-       u32 ufo_size = 0;
        void *tmp_v_addr;
        dma_addr_t tmp_p_addr;
        struct mac_info *mac_control;
@@ -850,7 +875,6 @@ static void free_shared_mem(struct s2io_nic *nic)
        lst_per_page = PAGE_SIZE / lst_size;
 
        for (i = 0; i < config->tx_fifo_num; i++) {
-               ufo_size += config->tx_cfg[i].fifo_len;
                page_num = TXD_MEM_PAGE_CNT(config->tx_cfg[i].fifo_len,
                                                        lst_per_page);
                for (j = 0; j < page_num; j++) {
@@ -940,18 +964,21 @@ static void free_shared_mem(struct s2io_nic *nic)
                }
        }
 
+       for (i = 0; i < nic->config.tx_fifo_num; i++) {
+               if (mac_control->fifos[i].ufo_in_band_v) {
+                       nic->mac_control.stats_info->sw_stat.mem_freed
+                               += (config->tx_cfg[i].fifo_len * sizeof(u64));
+                       kfree(mac_control->fifos[i].ufo_in_band_v);
+               }
+       }
+
        if (mac_control->stats_mem) {
+               nic->mac_control.stats_info->sw_stat.mem_freed +=
+                       mac_control->stats_mem_sz;
                pci_free_consistent(nic->pdev,
                                    mac_control->stats_mem_sz,
                                    mac_control->stats_mem,
                                    mac_control->stats_mem_phy);
-               nic->mac_control.stats_info->sw_stat.mem_freed +=
-                       mac_control->stats_mem_sz;
-       }
-       if (nic->ufo_in_band_v) {
-               kfree(nic->ufo_in_band_v);
-               nic->mac_control.stats_info->sw_stat.mem_freed
-                       += (ufo_size * sizeof(u64));
        }
 }
 
@@ -1052,8 +1079,67 @@ static int s2io_print_pci_mode(struct s2io_nic *nic)
 }
 
 /**
+ *  init_tti - Initialization transmit traffic interrupt scheme
+ *  @nic: device private variable
+ *  @link: link status (UP/DOWN) used to enable/disable continuous
+ *  transmit interrupts
+ *  Description: The function configures transmit traffic interrupts
+ *  Return Value:  SUCCESS on success and
+ *  '-1' on failure
+ */
+
+int init_tti(struct s2io_nic *nic, int link)
+{
+       struct XENA_dev_config __iomem *bar0 = nic->bar0;
+       register u64 val64 = 0;
+       int i;
+       struct config_param *config;
+
+       config = &nic->config;
+
+       for (i = 0; i < config->tx_fifo_num; i++) {
+               /*
+                * TTI Initialization. Default Tx timer gets us about
+                * 250 interrupts per sec. Continuous interrupts are enabled
+                * by default.
+                */
+               if (nic->device_type == XFRAME_II_DEVICE) {
+                       int count = (nic->config.bus_speed * 125)/2;
+                       val64 = TTI_DATA1_MEM_TX_TIMER_VAL(count);
+               } else
+                       val64 = TTI_DATA1_MEM_TX_TIMER_VAL(0x2078);
+
+               val64 |= TTI_DATA1_MEM_TX_URNG_A(0xA) |
+                               TTI_DATA1_MEM_TX_URNG_B(0x10) |
+                               TTI_DATA1_MEM_TX_URNG_C(0x30) |
+                               TTI_DATA1_MEM_TX_TIMER_AC_EN;
+
+               if (use_continuous_tx_intrs && (link == LINK_UP))
+                       val64 |= TTI_DATA1_MEM_TX_TIMER_CI_EN;
+               writeq(val64, &bar0->tti_data1_mem);
+
+               val64 = TTI_DATA2_MEM_TX_UFC_A(0x10) |
+                               TTI_DATA2_MEM_TX_UFC_B(0x20) |
+                               TTI_DATA2_MEM_TX_UFC_C(0x40) |
+                               TTI_DATA2_MEM_TX_UFC_D(0x80);
+
+               writeq(val64, &bar0->tti_data2_mem);
+
+               val64 = TTI_CMD_MEM_WE | TTI_CMD_MEM_STROBE_NEW_CMD |
+                               TTI_CMD_MEM_OFFSET(i);
+               writeq(val64, &bar0->tti_command_mem);
+
+               if (wait_for_cmd_complete(&bar0->tti_command_mem,
+                       TTI_CMD_MEM_STROBE_NEW_CMD, S2IO_BIT_RESET) != SUCCESS)
+                       return FAILURE;
+       }
+
+       return SUCCESS;
+}
+
+/**
  *  init_nic - Initialization of hardware
- *  @nic: device peivate variable
+ *  @nic: device private variable
  *  Description: The function sequentially configures every block
  *  of the H/W from their reset values.
  *  Return Value:  SUCCESS on success and
@@ -1158,9 +1244,9 @@ static int init_nic(struct s2io_nic *nic)
 
        for (i = 0, j = 0; i < config->tx_fifo_num; i++) {
                val64 |=
-                   vBIT(config->tx_cfg[i].fifo_len - 1, ((i * 32) + 19),
+                   vBIT(config->tx_cfg[i].fifo_len - 1, ((j * 32) + 19),
                         13) | vBIT(config->tx_cfg[i].fifo_priority,
-                                   ((i * 32) + 5), 3);
+                                   ((j * 32) + 5), 3);
 
                if (i == (config->tx_fifo_num - 1)) {
                        if (i % 2 == 0)
@@ -1171,17 +1257,25 @@ static int init_nic(struct s2io_nic *nic)
                case 1:
                        writeq(val64, &bar0->tx_fifo_partition_0);
                        val64 = 0;
+                       j = 0;
                        break;
                case 3:
                        writeq(val64, &bar0->tx_fifo_partition_1);
                        val64 = 0;
+                       j = 0;
                        break;
                case 5:
                        writeq(val64, &bar0->tx_fifo_partition_2);
                        val64 = 0;
+                       j = 0;
                        break;
                case 7:
                        writeq(val64, &bar0->tx_fifo_partition_3);
+                       val64 = 0;
+                       j = 0;
+                       break;
+               default:
+                       j++;
                        break;
                }
        }
@@ -1267,11 +1361,11 @@ static int init_nic(struct s2io_nic *nic)
 
        /*
         * Filling Tx round robin registers
-        * as per the number of FIFOs
+        * as per the number of FIFOs for equal scheduling priority
         */
        switch (config->tx_fifo_num) {
        case 1:
-               val64 = 0x0000000000000000ULL;
+               val64 = 0x0;
                writeq(val64, &bar0->tx_w_round_robin_0);
                writeq(val64, &bar0->tx_w_round_robin_1);
                writeq(val64, &bar0->tx_w_round_robin_2);
@@ -1279,87 +1373,78 @@ static int init_nic(struct s2io_nic *nic)
                writeq(val64, &bar0->tx_w_round_robin_4);
                break;
        case 2:
-               val64 = 0x0000010000010000ULL;
+               val64 = 0x0001000100010001ULL;
                writeq(val64, &bar0->tx_w_round_robin_0);
-               val64 = 0x0100000100000100ULL;
                writeq(val64, &bar0->tx_w_round_robin_1);
-               val64 = 0x0001000001000001ULL;
                writeq(val64, &bar0->tx_w_round_robin_2);
-               val64 = 0x0000010000010000ULL;
                writeq(val64, &bar0->tx_w_round_robin_3);
-               val64 = 0x0100000000000000ULL;
+               val64 = 0x0001000100000000ULL;
                writeq(val64, &bar0->tx_w_round_robin_4);
                break;
        case 3:
-               val64 = 0x0001000102000001ULL;
+               val64 = 0x0001020001020001ULL;
                writeq(val64, &bar0->tx_w_round_robin_0);
-               val64 = 0x0001020000010001ULL;
+               val64 = 0x0200010200010200ULL;
                writeq(val64, &bar0->tx_w_round_robin_1);
-               val64 = 0x0200000100010200ULL;
+               val64 = 0x0102000102000102ULL;
                writeq(val64, &bar0->tx_w_round_robin_2);
-               val64 = 0x0001000102000001ULL;
+               val64 = 0x0001020001020001ULL;
                writeq(val64, &bar0->tx_w_round_robin_3);
-               val64 = 0x0001020000000000ULL;
+               val64 = 0x0200010200000000ULL;
                writeq(val64, &bar0->tx_w_round_robin_4);
                break;
        case 4:
-               val64 = 0x0001020300010200ULL;
+               val64 = 0x0001020300010203ULL;
                writeq(val64, &bar0->tx_w_round_robin_0);
-               val64 = 0x0100000102030001ULL;
                writeq(val64, &bar0->tx_w_round_robin_1);
-               val64 = 0x0200010000010203ULL;
                writeq(val64, &bar0->tx_w_round_robin_2);
-               val64 = 0x0001020001000001ULL;
                writeq(val64, &bar0->tx_w_round_robin_3);
-               val64 = 0x0203000100000000ULL;
+               val64 = 0x0001020300000000ULL;
                writeq(val64, &bar0->tx_w_round_robin_4);
                break;
        case 5:
-               val64 = 0x0001000203000102ULL;
+               val64 = 0x0001020304000102ULL;
                writeq(val64, &bar0->tx_w_round_robin_0);
-               val64 = 0x0001020001030004ULL;
+               val64 = 0x0304000102030400ULL;
                writeq(val64, &bar0->tx_w_round_robin_1);
-               val64 = 0x0001000203000102ULL;
+               val64 = 0x0102030400010203ULL;
                writeq(val64, &bar0->tx_w_round_robin_2);
-               val64 = 0x0001020001030004ULL;
+               val64 = 0x0400010203040001ULL;
                writeq(val64, &bar0->tx_w_round_robin_3);
-               val64 = 0x0001000000000000ULL;
+               val64 = 0x0203040000000000ULL;
                writeq(val64, &bar0->tx_w_round_robin_4);
                break;
        case 6:
-               val64 = 0x0001020304000102ULL;
+               val64 = 0x0001020304050001ULL;
                writeq(val64, &bar0->tx_w_round_robin_0);
-               val64 = 0x0304050001020001ULL;
+               val64 = 0x0203040500010203ULL;
                writeq(val64, &bar0->tx_w_round_robin_1);
-               val64 = 0x0203000100000102ULL;
+               val64 = 0x0405000102030405ULL;
                writeq(val64, &bar0->tx_w_round_robin_2);
-               val64 = 0x0304000102030405ULL;
+               val64 = 0x0001020304050001ULL;
                writeq(val64, &bar0->tx_w_round_robin_3);
-               val64 = 0x0001000200000000ULL;
+               val64 = 0x0203040500000000ULL;
                writeq(val64, &bar0->tx_w_round_robin_4);
                break;
        case 7:
-               val64 = 0x0001020001020300ULL;
+               val64 = 0x0001020304050600ULL;
                writeq(val64, &bar0->tx_w_round_robin_0);
-               val64 = 0x0102030400010203ULL;
+               val64 = 0x0102030405060001ULL;
                writeq(val64, &bar0->tx_w_round_robin_1);
-               val64 = 0x0405060001020001ULL;
+               val64 = 0x0203040506000102ULL;
                writeq(val64, &bar0->tx_w_round_robin_2);
-               val64 = 0x0304050000010200ULL;
+               val64 = 0x0304050600010203ULL;
                writeq(val64, &bar0->tx_w_round_robin_3);
-               val64 = 0x0102030000000000ULL;
+               val64 = 0x0405060000000000ULL;
                writeq(val64, &bar0->tx_w_round_robin_4);
                break;
        case 8:
-               val64 = 0x0001020300040105ULL;
+               val64 = 0x0001020304050607ULL;
                writeq(val64, &bar0->tx_w_round_robin_0);
-               val64 = 0x0200030106000204ULL;
                writeq(val64, &bar0->tx_w_round_robin_1);
-               val64 = 0x0103000502010007ULL;
                writeq(val64, &bar0->tx_w_round_robin_2);
-               val64 = 0x0304010002060500ULL;
                writeq(val64, &bar0->tx_w_round_robin_3);
-               val64 = 0x0103020400000000ULL;
+               val64 = 0x0001020300000000ULL;
                writeq(val64, &bar0->tx_w_round_robin_4);
                break;
        }
@@ -1536,58 +1621,14 @@ static int init_nic(struct s2io_nic *nic)
            MAC_RX_LINK_UTIL_VAL(rmac_util_period);
        writeq(val64, &bar0->mac_link_util);
 
-
        /*
         * Initializing the Transmit and Receive Traffic Interrupt
         * Scheme.
         */
-       /*
-        * TTI Initialization. Default Tx timer gets us about
-        * 250 interrupts per sec. Continuous interrupts are enabled
-        * by default.
-        */
-       if (nic->device_type == XFRAME_II_DEVICE) {
-               int count = (nic->config.bus_speed * 125)/2;
-               val64 = TTI_DATA1_MEM_TX_TIMER_VAL(count);
-       } else {
-
-               val64 = TTI_DATA1_MEM_TX_TIMER_VAL(0x2078);
-       }
-       val64 |= TTI_DATA1_MEM_TX_URNG_A(0xA) |
-           TTI_DATA1_MEM_TX_URNG_B(0x10) |
-           TTI_DATA1_MEM_TX_URNG_C(0x30) | TTI_DATA1_MEM_TX_TIMER_AC_EN;
-               if (use_continuous_tx_intrs)
-                       val64 |= TTI_DATA1_MEM_TX_TIMER_CI_EN;
-       writeq(val64, &bar0->tti_data1_mem);
-
-       val64 = TTI_DATA2_MEM_TX_UFC_A(0x10) |
-           TTI_DATA2_MEM_TX_UFC_B(0x20) |
-           TTI_DATA2_MEM_TX_UFC_C(0x40) | TTI_DATA2_MEM_TX_UFC_D(0x80);
-       writeq(val64, &bar0->tti_data2_mem);
-
-       val64 = TTI_CMD_MEM_WE | TTI_CMD_MEM_STROBE_NEW_CMD;
-       writeq(val64, &bar0->tti_command_mem);
 
-       /*
-        * Once the operation completes, the Strobe bit of the command
-        * register will be reset. We poll for this particular condition
-        * We wait for a maximum of 500ms for the operation to complete,
-        * if it's not complete by then we return error.
-        */
-       time = 0;
-       while (TRUE) {
-               val64 = readq(&bar0->tti_command_mem);
-               if (!(val64 & TTI_CMD_MEM_STROBE_NEW_CMD)) {
-                       break;
-               }
-               if (time > 10) {
-                       DBG_PRINT(ERR_DBG, "%s: TTI init Failed\n",
-                                 dev->name);
-                       return -ENODEV;
-               }
-               msleep(50);
-               time++;
-       }
+       /* Initialize TTI */
+       if (SUCCESS != init_tti(nic, nic->last_link_state))
+               return -ENODEV;
 
        /* RTI Initialization */
        if (nic->device_type == XFRAME_II_DEVICE) {
@@ -2241,7 +2282,7 @@ static struct sk_buff *s2io_txdl_getskb(struct fifo_info *fifo_data, struct \
        u16 j, frg_cnt;
 
        txds = txdlp;
-       if (txds->Host_Control == (u64)(long)nic->ufo_in_band_v) {
+       if (txds->Host_Control == (u64)(long)fifo_data->ufo_in_band_v) {
                pci_unmap_single(nic->pdev, (dma_addr_t)
                        txds->Buffer_Pointer, sizeof(u64),
                        PCI_DMA_TODEVICE);
@@ -2296,6 +2337,8 @@ static void free_tx_buffers(struct s2io_nic *nic)
        config = &nic->config;
 
        for (i = 0; i < config->tx_fifo_num; i++) {
+               unsigned long flags;
+               spin_lock_irqsave(&mac_control->fifos[i].tx_lock, flags);
                for (j = 0; j < config->tx_cfg[i].fifo_len - 1; j++) {
                        txdp = (struct TxD *) \
                        mac_control->fifos[i].list_info[j].list_virt_addr;
@@ -2312,6 +2355,7 @@ static void free_tx_buffers(struct s2io_nic *nic)
                          dev->name, cnt, i);
                mac_control->fifos[i].tx_curr_get_info.offset = 0;
                mac_control->fifos[i].tx_curr_put_info.offset = 0;
+               spin_unlock_irqrestore(&mac_control->fifos[i].tx_lock, flags);
        }
 }
 
@@ -2932,8 +2976,12 @@ static void tx_intr_handler(struct fifo_info *fifo_data)
        struct tx_curr_get_info get_info, put_info;
        struct sk_buff *skb;
        struct TxD *txdlp;
+       unsigned long flags = 0;
        u8 err_mask;
 
+       if (!spin_trylock_irqsave(&fifo_data->tx_lock, flags))
+                       return;
+
        get_info = fifo_data->tx_curr_get_info;
        memcpy(&put_info, &fifo_data->tx_curr_put_info, sizeof(put_info));
        txdlp = (struct TxD *) fifo_data->list_info[get_info.offset].
@@ -2982,6 +3030,7 @@ static void tx_intr_handler(struct fifo_info *fifo_data)
 
                skb = s2io_txdl_getskb(fifo_data, txdlp, get_info.offset);
                if (skb == NULL) {
+                       spin_unlock_irqrestore(&fifo_data->tx_lock, flags);
                        DBG_PRINT(ERR_DBG, "%s: Null skb ",
                        __FUNCTION__);
                        DBG_PRINT(ERR_DBG, "in Tx Free Intr\n");
@@ -3002,10 +3051,10 @@ static void tx_intr_handler(struct fifo_info *fifo_data)
                    get_info.offset;
        }
 
-       spin_lock(&nic->tx_lock);
        if (netif_queue_stopped(dev))
                netif_wake_queue(dev);
-       spin_unlock(&nic->tx_lock);
+
+       spin_unlock_irqrestore(&fifo_data->tx_lock, flags);
 }
 
 /**
@@ -3772,7 +3821,7 @@ static int s2io_test_msi(struct s2io_nic *sp)
 
        if (!sp->msi_detected) {
                /* MSI(X) test failed, go back to INTx mode */
-               DBG_PRINT(ERR_DBG, "%s: PCI %s: No interrupt was generated"
+               DBG_PRINT(ERR_DBG, "%s: PCI %s: No interrupt was generated "
                        "using MSI(X) during test\n", sp->dev->name,
                        pci_name(pdev));
 
@@ -3965,9 +4014,10 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
        register u64 val64;
        struct TxD *txdp;
        struct TxFIFO_element __iomem *tx_fifo;
-       unsigned long flags;
+       unsigned long flags = 0;
        u16 vlan_tag = 0;
        int vlan_priority = 0;
+       struct fifo_info *fifo = NULL;
        struct mac_info *mac_control;
        struct config_param *config;
        int offload_type;
@@ -3982,13 +4032,11 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
                DBG_PRINT(TX_DBG, "%s:Buffer has no data..\n", dev->name);
                dev_kfree_skb_any(skb);
                return 0;
-}
+       }
 
-       spin_lock_irqsave(&sp->tx_lock, flags);
        if (!is_s2io_card_up(sp)) {
                DBG_PRINT(TX_DBG, "%s: Card going down for reset\n",
                          dev->name);
-               spin_unlock_irqrestore(&sp->tx_lock, flags);
                dev_kfree_skb(skb);
                return 0;
        }
@@ -4001,19 +4049,20 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
                queue = config->fifo_mapping[vlan_priority];
        }
 
-       put_off = (u16) mac_control->fifos[queue].tx_curr_put_info.offset;
-       get_off = (u16) mac_control->fifos[queue].tx_curr_get_info.offset;
-       txdp = (struct TxD *) mac_control->fifos[queue].list_info[put_off].
-               list_virt_addr;
+       fifo = &mac_control->fifos[queue];
+       spin_lock_irqsave(&fifo->tx_lock, flags);
+       put_off = (u16) fifo->tx_curr_put_info.offset;
+       get_off = (u16) fifo->tx_curr_get_info.offset;
+       txdp = (struct TxD *) fifo->list_info[put_off].list_virt_addr;
 
-       queue_len = mac_control->fifos[queue].tx_curr_put_info.fifo_len + 1;
+       queue_len = fifo->tx_curr_put_info.fifo_len + 1;
        /* Avoid "put" pointer going beyond "get" pointer */
        if (txdp->Host_Control ||
                   ((put_off+1) == queue_len ? 0 : (put_off+1)) == get_off) {
                DBG_PRINT(TX_DBG, "Error in xmit, No free TXDs.\n");
                netif_stop_queue(dev);
                dev_kfree_skb(skb);
-               spin_unlock_irqrestore(&sp->tx_lock, flags);
+               spin_unlock_irqrestore(&fifo->tx_lock, flags);
                return 0;
        }
 
@@ -4029,7 +4078,7 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
        }
        txdp->Control_1 |= TXD_GATHER_CODE_FIRST;
        txdp->Control_1 |= TXD_LIST_OWN_XENA;
-       txdp->Control_2 |= config->tx_intr_type;
+       txdp->Control_2 |= TXD_INT_NUMBER(fifo->fifo_no);
 
        if (sp->vlgrp && vlan_tx_tag_present(skb)) {
                txdp->Control_2 |= TXD_VLAN_ENABLE;
@@ -4046,15 +4095,15 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
                txdp->Control_1 |= TXD_UFO_MSS(ufo_size);
                txdp->Control_1 |= TXD_BUFFER0_SIZE(8);
 #ifdef __BIG_ENDIAN
-               sp->ufo_in_band_v[put_off] =
+               fifo->ufo_in_band_v[put_off] =
                                (u64)skb_shinfo(skb)->ip6_frag_id;
 #else
-               sp->ufo_in_band_v[put_off] =
+               fifo->ufo_in_band_v[put_off] =
                                (u64)skb_shinfo(skb)->ip6_frag_id << 32;
 #endif
-               txdp->Host_Control = (unsigned long)sp->ufo_in_band_v;
+               txdp->Host_Control = (unsigned long)fifo->ufo_in_band_v;
                txdp->Buffer_Pointer = pci_map_single(sp->pdev,
-                                       sp->ufo_in_band_v,
+                                       fifo->ufo_in_band_v,
                                        sizeof(u64), PCI_DMA_TODEVICE);
                if((txdp->Buffer_Pointer == 0) ||
                        (txdp->Buffer_Pointer == DMA_ERROR_CODE))
@@ -4094,7 +4143,7 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
                frg_cnt++; /* as Txd0 was used for inband header */
 
        tx_fifo = mac_control->tx_FIFO_start[queue];
-       val64 = mac_control->fifos[queue].list_info[put_off].list_phy_addr;
+       val64 = fifo->list_info[put_off].list_phy_addr;
        writeq(val64, &tx_fifo->TxDL_Pointer);
 
        val64 = (TX_FIFO_LAST_TXD_NUM(frg_cnt) | TX_FIFO_FIRST_LIST |
@@ -4107,9 +4156,9 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
        mmiowb();
 
        put_off++;
-       if (put_off == mac_control->fifos[queue].tx_curr_put_info.fifo_len + 1)
+       if (put_off == fifo->tx_curr_put_info.fifo_len + 1)
                put_off = 0;
-       mac_control->fifos[queue].tx_curr_put_info.offset = put_off;
+       fifo->tx_curr_put_info.offset = put_off;
 
        /* Avoid "put" pointer going beyond "get" pointer */
        if (((put_off+1) == queue_len ? 0 : (put_off+1)) == get_off) {
@@ -4121,7 +4170,7 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
        }
        mac_control->stats_info->sw_stat.mem_allocated += skb->truesize;
        dev->trans_start = jiffies;
-       spin_unlock_irqrestore(&sp->tx_lock, flags);
+       spin_unlock_irqrestore(&fifo->tx_lock, flags);
 
        return 0;
 pci_map_failed:
@@ -4129,7 +4178,7 @@ pci_map_failed:
        netif_stop_queue(dev);
        stats->mem_freed += skb->truesize;
        dev_kfree_skb(skb);
-       spin_unlock_irqrestore(&sp->tx_lock, flags);
+       spin_unlock_irqrestore(&fifo->tx_lock, flags);
        return 0;
 }
 
@@ -6868,7 +6917,7 @@ static int s2io_add_isr(struct s2io_nic * sp)
                                /* If either data or addr is zero print it */
                                if(!(sp->msix_info[i].addr &&
                                        sp->msix_info[i].data)) {
-                                       DBG_PRINT(ERR_DBG, "%s @ Addr:0x%llx"
+                                       DBG_PRINT(ERR_DBG, "%s @ Addr:0x%llx "
                                                "Data:0x%lx\n",sp->desc[i],
                                                (unsigned long long)
                                                sp->msix_info[i].addr,
@@ -6886,7 +6935,7 @@ static int s2io_add_isr(struct s2io_nic * sp)
                                /* If either data or addr is zero print it */
                                if(!(sp->msix_info[i].addr &&
                                        sp->msix_info[i].data)) {
-                                       DBG_PRINT(ERR_DBG, "%s @ Addr:0x%llx"
+                                       DBG_PRINT(ERR_DBG, "%s @ Addr:0x%llx "
                                                "Data:0x%lx\n",sp->desc[i],
                                                (unsigned long long)
                                                sp->msix_info[i].addr,
@@ -6995,10 +7044,8 @@ static void do_s2io_card_down(struct s2io_nic * sp, int do_io)
        if (do_io)
                s2io_reset(sp);
 
-       spin_lock_irqsave(&sp->tx_lock, flags);
        /* Free all Tx buffers */
        free_tx_buffers(sp);
-       spin_unlock_irqrestore(&sp->tx_lock, flags);
 
        /* Free all Rx buffers */
        spin_lock_irqsave(&sp->rx_lock, flags);
@@ -7410,6 +7457,7 @@ static void s2io_link(struct s2io_nic * sp, int link)
        struct net_device *dev = (struct net_device *) sp->dev;
 
        if (link != sp->last_link_state) {
+               init_tti(sp, link);
                if (link == LINK_DOWN) {
                        DBG_PRINT(ERR_DBG, "%s: Link down\n", dev->name);
                        netif_carrier_off(dev);
@@ -7462,12 +7510,18 @@ static void s2io_init_pci(struct s2io_nic * sp)
 
 static int s2io_verify_parm(struct pci_dev *pdev, u8 *dev_intr_type)
 {
-       if ( tx_fifo_num > 8) {
-               DBG_PRINT(ERR_DBG, "s2io: Requested number of Tx fifos not "
-                        "supported\n");
-               DBG_PRINT(ERR_DBG, "s2io: Default to 8 Tx fifos\n");
-               tx_fifo_num = 8;
+       if ((tx_fifo_num > MAX_TX_FIFOS) ||
+               (tx_fifo_num < FIFO_DEFAULT_NUM)) {
+               DBG_PRINT(ERR_DBG, "s2io: Requested number of tx fifos "
+                       "(%d) not supported\n", tx_fifo_num);
+               tx_fifo_num =
+                       ((tx_fifo_num > MAX_TX_FIFOS)? MAX_TX_FIFOS :
+                       ((tx_fifo_num < FIFO_DEFAULT_NUM) ? FIFO_DEFAULT_NUM :
+                       tx_fifo_num));
+               DBG_PRINT(ERR_DBG, "s2io: Default to %d ", tx_fifo_num);
+               DBG_PRINT(ERR_DBG, "tx fifos\n");
        }
+
        if ( rx_ring_num > 8) {
                DBG_PRINT(ERR_DBG, "s2io: Requested number of Rx rings not "
                         "supported\n");
@@ -7502,7 +7556,7 @@ static int s2io_verify_parm(struct pci_dev *pdev, u8 *dev_intr_type)
 /**
  * rts_ds_steer - Receive traffic steering based on IPv4 or IPv6 TOS
  * or Traffic class respectively.
- * @nic: device peivate variable
+ * @nic: device private variable
  * Description: The function configures the receive steering to
  * desired receive ring.
  * Return Value:  SUCCESS on success and
@@ -7846,7 +7900,8 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
        sp->state = 0;
 
        /* Initialize spinlocks */
-       spin_lock_init(&sp->tx_lock);
+       for (i = 0; i < sp->config.tx_fifo_num; i++)
+               spin_lock_init(&mac_control->fifos[i].tx_lock);
 
        if (!napi)
                spin_lock_init(&sp->put_lock);
@@ -8063,7 +8118,7 @@ static void initiate_new_session(struct lro *lro, u8 *l2h,
        lro->iph = ip;
        lro->tcph = tcp;
        lro->tcp_next_seq = tcp_pyld_len + ntohl(tcp->seq);
-       lro->tcp_ack = ntohl(tcp->ack_seq);
+       lro->tcp_ack = tcp->ack_seq;
        lro->sg_num = 1;
        lro->total_len = ntohs(ip->tot_len);
        lro->frags_len = 0;
@@ -8072,10 +8127,10 @@ static void initiate_new_session(struct lro *lro, u8 *l2h,
         * already been done.
         */
        if (tcp->doff == 8) {
-               u32 *ptr;
-               ptr = (u32 *)(tcp+1);
+               __be32 *ptr;
+               ptr = (__be32 *)(tcp+1);
                lro->saw_ts = 1;
-               lro->cur_tsval = *(ptr+1);
+               lro->cur_tsval = ntohl(*(ptr+1));
                lro->cur_tsecr = *(ptr+2);
        }
        lro->in_use = 1;
@@ -8101,7 +8156,7 @@ static void update_L3L4_header(struct s2io_nic *sp, struct lro *lro)
 
        /* Update tsecr field if this session has timestamps enabled */
        if (lro->saw_ts) {
-               u32 *ptr = (u32 *)(tcp + 1);
+               __be32 *ptr = (__be32 *)(tcp + 1);
                *(ptr+2) = lro->cur_tsecr;
        }
 
@@ -8126,10 +8181,10 @@ static void aggregate_new_rx(struct lro *lro, struct iphdr *ip,
        lro->window = tcp->window;
 
        if (lro->saw_ts) {
-               u32 *ptr;
+               __be32 *ptr;
                /* Update tsecr and tsval from this packet */
-               ptr = (u32 *) (tcp + 1);
-               lro->cur_tsval = *(ptr + 1);
+               ptr = (__be32 *)(tcp+1);
+               lro->cur_tsval = ntohl(*(ptr+1));
                lro->cur_tsecr = *(ptr + 2);
        }
 }
@@ -8180,11 +8235,11 @@ static int verify_l3_l4_lro_capable(struct lro *l_lro, struct iphdr *ip,
 
                /* Ensure timestamp value increases monotonically */
                if (l_lro)
-                       if (l_lro->cur_tsval > *((u32 *)(ptr+2)))
+                       if (l_lro->cur_tsval > ntohl(*((__be32 *)(ptr+2))))
                                return -1;
 
                /* timestamp echo reply should be non-zero */
-               if (*((u32 *)(ptr+6)) == 0)
+               if (*((__be32 *)(ptr+6)) == 0)
                        return -1;
        }