netxen: fix race in tx ring acccess

Fix the distance check between tx ring producer and consumer that
could lead to tx ring wrap around.

Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index 9f5ced3eaf9d5c59ae5c2a1d810edaafe32bfd36..23c974a7e0e487532bbf3d5f2be6d1ceb87e3e02 100644 (file)
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -526,7 +526,7 @@ netxen_send_cmd_descs(struct netxen_adapter *adapter,
        producer = tx_ring->producer;
        consumer = tx_ring->sw_consumer;
 
-       if (nr_desc > find_diff_among(producer, consumer, tx_ring->num_desc)) {
+       if (nr_desc >= find_diff_among(producer, consumer, tx_ring->num_desc)) {
                netif_tx_unlock_bh(adapter->netdev);
                return -EBUSY;
        }
@@ -752,7 +752,7 @@ int netxen_linkevent_request(struct netxen_adapter *adapter, int enable)
 
        word = NX_NIC_H2C_OPCODE_GET_LINKEVENT | ((u64)adapter->portnum << 16);
        req.req_hdr = cpu_to_le64(word);
-       req.words[0] = cpu_to_le64(enable);
+       req.words[0] = cpu_to_le64(enable | (enable << 8));
 
        rv = netxen_send_cmd_descs(adapter, (struct cmd_desc_type0 *)&req, 1);
        if (rv != 0) {

diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index d18216779a0930135dfed74e3a3cb61048ad281d..de9ebbd841b78e89c74d3b6cc8480c5988a016aa 100644 (file)
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -1319,10 +1319,11 @@ int netxen_process_cmd_ring(struct netxen_adapter *adapter)
                        break;
        }
 
-       if (count) {
-               tx_ring->sw_consumer = sw_consumer;
+       tx_ring->sw_consumer = sw_consumer;
+
+       if (count && netif_running(netdev)) {
                smp_mb();
-               if (netif_queue_stopped(netdev) && netif_running(netdev)) {
+               if (netif_queue_stopped(netdev) && netif_carrier_ok(netdev)) {
                        netif_tx_lock(netdev);
                        netif_wake_queue(netdev);
                        smp_mb();
@@ -1450,7 +1451,6 @@ netxen_post_rx_buffers_nodb(struct netxen_adapter *adapter,
                rds_ring->producer = producer;
                NXWR32(adapter, rds_ring->crb_rcv_producer,
                                (producer - 1) & (rds_ring->num_desc - 1));
-                       wmb();
        }
        spin_unlock(&rds_ring->lock);
 }

diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 5d79c19a6ec06d2978f63a3b1cd48c8af90fe6f5..6a496b1909eb93b25e500769eaf81e25719ea61b 100644 (file)
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -809,6 +809,7 @@ netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
 {
        netif_carrier_off(netdev);
        netif_stop_queue(netdev);
+       smp_mb();
        netxen_napi_disable(adapter);
 
        if (adapter->stop_port)
@@ -1340,7 +1341,7 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
        producer = tx_ring->producer;
        smp_mb();
        consumer = tx_ring->sw_consumer;
-       if ((no_of_desc+2) > find_diff_among(producer, consumer, num_txd)) {
+       if ((no_of_desc+2) >= find_diff_among(producer, consumer, num_txd)) {
                netif_stop_queue(netdev);
                smp_mb();
                return NETDEV_TX_BUSY;