1 files changed, 36 insertions, 24 deletions

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 4dd0668003e7..5b97cc946d70 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -87,7 +87,7 @@ struct netfront_cb {
 /* IRQ name is queue name with "-tx" or "-rx" appended */
 #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3)
 
-static DECLARE_WAIT_QUEUE_HEAD(module_unload_q);
+static DECLARE_WAIT_QUEUE_HEAD(module_wq);
 
 struct netfront_stats {
         u64                     packets;
@@ -239,7 +239,7 @@ static void rx_refill_timeout(struct timer_list *t)
 static int netfront_tx_slot_available(struct netfront_queue *queue)
 {
         return (queue->tx.req_prod_pvt - queue->tx.rsp_cons) <
-                (NET_TX_RING_SIZE - MAX_SKB_FRAGS - 2);
+                (NET_TX_RING_SIZE - XEN_NETIF_NR_SLOTS_MIN - 1);
 }
 
 static void xennet_maybe_wake_tx(struct netfront_queue *queue)
@@ -545,7 +545,8 @@ static int xennet_count_skb_slots(struct sk_buff *skb)
 }
 
 static u16 xennet_select_queue(struct net_device *dev, struct sk_buff *skb,
-                               void *accel_priv, select_queue_fallback_t fallback)
+                               struct net_device *sb_dev,
+                               select_queue_fallback_t fallback)
 {
         unsigned int num_queues = dev->real_num_tx_queues;
         u32 hash;
@@ -564,7 +565,7 @@ static u16 xennet_select_queue(struct net_device *dev, struct sk_buff *skb,
 
 #define MAX_XEN_SKB_FRAGS (65536 / XEN_PAGE_SIZE + 1)
 
-static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct netfront_info *np = netdev_priv(dev);
         struct netfront_stats *tx_stats = this_cpu_ptr(np->tx_stats);
@@ -790,7 +791,7 @@ static int xennet_get_responses(struct netfront_queue *queue,
         RING_IDX cons = queue->rx.rsp_cons;
         struct sk_buff *skb = xennet_get_rx_skb(queue, cons);
         grant_ref_t ref = xennet_get_rx_ref(queue, cons);
-        int max = MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD);
+        int max = XEN_NETIF_NR_SLOTS_MIN + (rx->status <= RX_COPY_THRESHOLD);
         int slots = 1;
         int err = 0;
         unsigned long ret;
@@ -893,7 +894,6 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
                                   struct sk_buff *skb,
                                   struct sk_buff_head *list)
 {
-        struct skb_shared_info *shinfo = skb_shinfo(skb);
         RING_IDX cons = queue->rx.rsp_cons;
         struct sk_buff *nskb;
 
@@ -902,15 +902,20 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
                         RING_GET_RESPONSE(&queue->rx, ++cons);
                 skb_frag_t *nfrag = &skb_shinfo(nskb)->frags[0];
 
-                if (shinfo->nr_frags == MAX_SKB_FRAGS) {
+                if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS) {
                         unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
 
-                        BUG_ON(pull_to <= skb_headlen(skb));
+                        BUG_ON(pull_to < skb_headlen(skb));
                         __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
                 }
-                BUG_ON(shinfo->nr_frags >= MAX_SKB_FRAGS);
+                if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
+                        queue->rx.rsp_cons = ++cons;
+                        kfree_skb(nskb);
+                        return ~0U;
+                }
 
-                skb_add_rx_frag(skb, shinfo->nr_frags, skb_frag_page(nfrag),
+                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+                                skb_frag_page(nfrag),
                                 rx->offset, rx->status, PAGE_SIZE);
 
                 skb_shinfo(nskb)->nr_frags = 0;
@@ -1044,6 +1049,8 @@ err:
                 skb->len += rx->status;
 
                 i = xennet_fill_frags(queue, skb, &tmpq);
+                if (unlikely(i == ~0U))
+                        goto err;
 
                 if (rx->flags & XEN_NETRXF_csum_blank)
                         skb->ip_summed = CHECKSUM_PARTIAL;
@@ -1330,6 +1337,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
         netif_carrier_off(netdev);
 
         xenbus_switch_state(dev, XenbusStateInitialising);
+        wait_event(module_wq,
+                   xenbus_read_driver_state(dev->otherend) !=
+                   XenbusStateClosed &&
+                   xenbus_read_driver_state(dev->otherend) !=
+                   XenbusStateUnknown);
         return netdev;
 
  exit:
@@ -1597,14 +1609,16 @@ static int xennet_init_queue(struct netfront_queue *queue)
 {
         unsigned short i;
         int err = 0;
+        char *devid;
 
         spin_lock_init(&queue->tx_lock);
         spin_lock_init(&queue->rx_lock);
 
         timer_setup(&queue->rx_refill_timer, rx_refill_timeout, 0);
 
-        snprintf(queue->name, sizeof(queue->name), "%s-q%u",
-                 queue->info->netdev->name, queue->id);
+        devid = strrchr(queue->info->xbdev->nodename, '/') + 1;
+        snprintf(queue->name, sizeof(queue->name), "vif%s-q%u",
+                 devid, queue->id);
 
         /* Initialise tx_skbs as a free chain containing every entry. */
         queue->tx_skb_freelist = 0;
@@ -1810,7 +1824,7 @@ static int talk_to_netback(struct xenbus_device *dev,
         err = xen_net_read_mac(dev, info->netdev->dev_addr);
         if (err) {
                 xenbus_dev_fatal(dev, err, "parsing %s/mac", dev->nodename);
-                goto out;
+                goto out_unlocked;
         }
 
         rtnl_lock();
@@ -1925,6 +1939,7 @@ abort_transaction_no_dev_fatal:
         xennet_destroy_queues(info);
  out:
         rtnl_unlock();
+out_unlocked:
         device_unregister(&dev->dev);
         return err;
 }
@@ -1950,10 +1965,6 @@ static int xennet_connect(struct net_device *dev)
         /* talk_to_netback() sets the correct number of queues */
         num_queues = dev->real_num_tx_queues;
 
-        rtnl_lock();
-        netdev_update_features(dev);
-        rtnl_unlock();
-
         if (dev->reg_state == NETREG_UNINITIALIZED) {
                 err = register_netdev(dev);
                 if (err) {
@@ -1963,6 +1974,10 @@ static int xennet_connect(struct net_device *dev)
                 }
         }
 
+        rtnl_lock();
+        netdev_update_features(dev);
+        rtnl_unlock();
+
         /*
          * All public and private state should now be sane.  Get
          * ready to start sending and receiving packets and give the driver
@@ -2000,15 +2015,14 @@ static void netback_changed(struct xenbus_device *dev,
 
         dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state));
 
+        wake_up_all(&module_wq);
+
         switch (backend_state) {
         case XenbusStateInitialising:
         case XenbusStateInitialised:
         case XenbusStateReconfiguring:
         case XenbusStateReconfigured:
-                break;
-
         case XenbusStateUnknown:
-                wake_up_all(&module_unload_q);
                 break;
 
         case XenbusStateInitWait:
@@ -2024,12 +2038,10 @@ static void netback_changed(struct xenbus_device *dev,
                 break;
 
         case XenbusStateClosed:
-                wake_up_all(&module_unload_q);
                 if (dev->state == XenbusStateClosed)
                         break;
                 /* Missed the backend's CLOSING state -- fallthrough */
         case XenbusStateClosing:
-                wake_up_all(&module_unload_q);
                 xenbus_frontend_closed(dev);
                 break;
         }
@@ -2137,14 +2149,14 @@ static int xennet_remove(struct xenbus_device *dev)
 
         if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) {
                 xenbus_switch_state(dev, XenbusStateClosing);
-                wait_event(module_unload_q,
+                wait_event(module_wq,
                            xenbus_read_driver_state(dev->otherend) ==
                            XenbusStateClosing ||
                            xenbus_read_driver_state(dev->otherend) ==
                            XenbusStateUnknown);
 
                 xenbus_switch_state(dev, XenbusStateClosed);
-                wait_event(module_unload_q,
+                wait_event(module_wq,
                            xenbus_read_driver_state(dev->otherend) ==
                            XenbusStateClosed ||
                            xenbus_read_driver_state(dev->otherend) ==