4 files changed, 88 insertions, 52 deletions

diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index a1977430ddfb..5715318d6bab 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -184,6 +184,7 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
                    unsigned long rx_ring_ref, unsigned int tx_evtchn,
                    unsigned int rx_evtchn);
 void xenvif_disconnect(struct xenvif *vif);
+void xenvif_free(struct xenvif *vif);
 
 int xenvif_xenbus_init(void);
 void xenvif_xenbus_fini(void);
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 625c6f49cfba..01bb854c7f62 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -353,6 +353,9 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         }
 
         netdev_dbg(dev, "Successfully created xenvif\n");
+
+        __module_get(THIS_MODULE);
+
         return vif;
 }
 
@@ -366,8 +369,6 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
         if (vif->tx_irq)
                 return 0;
 
-        __module_get(THIS_MODULE);
-
         err = xenvif_map_frontend_rings(vif, tx_ring_ref, rx_ring_ref);
         if (err < 0)
                 goto err;
@@ -406,7 +407,7 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
 
         init_waitqueue_head(&vif->wq);
         vif->task = kthread_create(xenvif_kthread,
-                                   (void *)vif, vif->dev->name);
+                                   (void *)vif, "%s", vif->dev->name);
         if (IS_ERR(vif->task)) {
                 pr_warn("Could not allocate kthread for %s\n", vif->dev->name);
                 err = PTR_ERR(vif->task);
@@ -452,12 +453,6 @@ void xenvif_carrier_off(struct xenvif *vif)
 
 void xenvif_disconnect(struct xenvif *vif)
 {
-        /* Disconnect funtion might get called by generic framework
-         * even before vif connects, so we need to check if we really
-         * need to do a module_put.
-         */
-        int need_module_put = 0;
-
         if (netif_carrier_ok(vif->dev))
                 xenvif_carrier_off(vif);
 
@@ -468,23 +463,22 @@ void xenvif_disconnect(struct xenvif *vif)
                         unbind_from_irqhandler(vif->tx_irq, vif);
                         unbind_from_irqhandler(vif->rx_irq, vif);
                 }
-                /* vif->irq is valid, we had a module_get in
-                 * xenvif_connect.
-                 */
-                need_module_put = 1;
+                vif->tx_irq = 0;
         }
 
         if (vif->task)
                 kthread_stop(vif->task);
 
+        xenvif_unmap_frontend_rings(vif);
+}
+
+void xenvif_free(struct xenvif *vif)
+{
         netif_napi_del(&vif->napi);
 
         unregister_netdev(vif->dev);
 
-        xenvif_unmap_frontend_rings(vif);
-
         free_netdev(vif->dev);
 
-        if (need_module_put)
-                module_put(THIS_MODULE);
+        module_put(THIS_MODULE);
 }
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 956130c70036..f3e591c611de 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -212,6 +212,49 @@ static bool start_new_rx_buffer(int offset, unsigned long size, int head)
         return false;
 }
 
+struct xenvif_count_slot_state {
+        unsigned long copy_off;
+        bool head;
+};
+
+unsigned int xenvif_count_frag_slots(struct xenvif *vif,
+                                     unsigned long offset, unsigned long size,
+                                     struct xenvif_count_slot_state *state)
+{
+        unsigned count = 0;
+
+        offset &= ~PAGE_MASK;
+
+        while (size > 0) {
+                unsigned long bytes;
+
+                bytes = PAGE_SIZE - offset;
+
+                if (bytes > size)
+                        bytes = size;
+
+                if (start_new_rx_buffer(state->copy_off, bytes, state->head)) {
+                        count++;
+                        state->copy_off = 0;
+                }
+
+                if (state->copy_off + bytes > MAX_BUFFER_OFFSET)
+                        bytes = MAX_BUFFER_OFFSET - state->copy_off;
+
+                state->copy_off += bytes;
+
+                offset += bytes;
+                size -= bytes;
+
+                if (offset == PAGE_SIZE)
+                        offset = 0;
+
+                state->head = false;
+        }
+
+        return count;
+}
+
 /*
  * Figure out how many ring slots we're going to need to send @skb to
  * the guest. This function is essentially a dry run of
@@ -219,48 +262,39 @@ static bool start_new_rx_buffer(int offset, unsigned long size, int head)
  */
 unsigned int xenvif_count_skb_slots(struct xenvif *vif, struct sk_buff *skb)
 {
+        struct xenvif_count_slot_state state;
         unsigned int count;
-        int i, copy_off;
+        unsigned char *data;
+        unsigned i;
 
-        count = DIV_ROUND_UP(skb_headlen(skb), PAGE_SIZE);
+        state.head = true;
+        state.copy_off = 0;
 
-        copy_off = skb_headlen(skb) % PAGE_SIZE;
+        /* Slot for the first (partial) page of data. */
+        count = 1;
 
+        /* Need a slot for the GSO prefix for GSO extra data? */
         if (skb_shinfo(skb)->gso_size)
                 count++;
 
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                unsigned long size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
-                unsigned long offset = skb_shinfo(skb)->frags[i].page_offset;
-                unsigned long bytes;
-
-                offset &= ~PAGE_MASK;
-
-                while (size > 0) {
-                        BUG_ON(offset >= PAGE_SIZE);
-                        BUG_ON(copy_off > MAX_BUFFER_OFFSET);
-
-                        bytes = PAGE_SIZE - offset;
-
-                        if (bytes > size)
-                                bytes = size;
+        data = skb->data;
+        while (data < skb_tail_pointer(skb)) {
+                unsigned long offset = offset_in_page(data);
+                unsigned long size = PAGE_SIZE - offset;
 
-                        if (start_new_rx_buffer(copy_off, bytes, 0)) {
-                                count++;
-                                copy_off = 0;
-                        }
+                if (data + size > skb_tail_pointer(skb))
+                        size = skb_tail_pointer(skb) - data;
 
-                        if (copy_off + bytes > MAX_BUFFER_OFFSET)
-                                bytes = MAX_BUFFER_OFFSET - copy_off;
+                count += xenvif_count_frag_slots(vif, offset, size, &state);
 
-                        copy_off += bytes;
+                data += size;
+        }
 
-                        offset += bytes;
-                        size -= bytes;
+        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                unsigned long size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
+                unsigned long offset = skb_shinfo(skb)->frags[i].page_offset;
 
-                        if (offset == PAGE_SIZE)
-                                offset = 0;
-                }
+                count += xenvif_count_frag_slots(vif, offset, size, &state);
         }
         return count;
 }
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 1fe48fe364ed..a53782ef1540 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -42,7 +42,7 @@ static int netback_remove(struct xenbus_device *dev)
         if (be->vif) {
                 kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
                 xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status");
-                xenvif_disconnect(be->vif);
+                xenvif_free(be->vif);
                 be->vif = NULL;
         }
         kfree(be);
@@ -213,9 +213,18 @@ static void disconnect_backend(struct xenbus_device *dev)
 {
         struct backend_info *be = dev_get_drvdata(&dev->dev);
 
+        if (be->vif)
+                xenvif_disconnect(be->vif);
+}
+
+static void destroy_backend(struct xenbus_device *dev)
+{
+        struct backend_info *be = dev_get_drvdata(&dev->dev);
+
         if (be->vif) {
+                kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
                 xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status");
-                xenvif_disconnect(be->vif);
+                xenvif_free(be->vif);
                 be->vif = NULL;
         }
 }
@@ -246,14 +255,11 @@ static void frontend_changed(struct xenbus_device *dev,
         case XenbusStateConnected:
                 if (dev->state == XenbusStateConnected)
                         break;
-                backend_create_xenvif(be);
                 if (be->vif)
                         connect(be);
                 break;
 
         case XenbusStateClosing:
-                if (be->vif)
-                        kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
                 disconnect_backend(dev);
                 xenbus_switch_state(dev, XenbusStateClosing);
                 break;
@@ -262,6 +268,7 @@ static void frontend_changed(struct xenbus_device *dev,
                 xenbus_switch_state(dev, XenbusStateClosed);
                 if (xenbus_dev_is_online(dev))
                         break;
+                destroy_backend(dev);
                 /* fall through if not online */
         case XenbusStateUnknown:
                 device_unregister(&dev->dev);