declance: Restore tx descriptor ring locking

A driver overhaul on 29 Feb 2000 (!) broke locking around fiddling with
the tx descriptor ring in start_xmit(); a follow-on "fix" removed the
broken remnants altogether.  Here's a patch to restore proper locking in
the function -- the complement in the interrupt handler has been correct
all the time.

 This *may* have been the reason for the occasional confusion of the chip
-- triggering a tx timeout followed by a chip reset sequence -- seen on
R4k-based DECstations with the onboard Ethernet interface.  Another theory
is the confusion is due to an unindentified problem -- perhaps a silicon
erratum -- associated with the variation of the MT ASIC used to interface
the R4k CPU to the rest of the system on these computers; with its
aggressive write-back buffering the design is particularly weakly ordered
when it comes to MMIO (in the absence of ordering barriers uncached reads
are allowed to bypass earlier uncached writes, even if to the same
location), which may trigger all kinds of corner cases in peripheral
hardware as well as software.

Either way this piece of code is buggy.

Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/declance.c b/drivers/net/declance.c
index b62405a6918040764d68639660ad902754653671..2b22e580c4ded83e7873fbbe5502f10c208aae0f 100644 (file)
--- a/drivers/net/declance.c
+++ b/drivers/net/declance.c
@@ -895,6 +895,7 @@ static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
        struct lance_private *lp = netdev_priv(dev);
        volatile struct lance_regs *ll = lp->ll;
        volatile u16 *ib = (volatile u16 *)dev->mem_start;
+       unsigned long flags;
        int entry, len;
 
        len = skb->len;
@@ -907,6 +908,8 @@ static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
        dev->stats.tx_bytes += len;
 
+       spin_lock_irqsave(&lp->lock, flags);
+
        entry = lp->tx_new;
        *lib_ptr(ib, btx_ring[entry].length, lp->type) = (-len);
        *lib_ptr(ib, btx_ring[entry].misc, lp->type) = 0;
@@ -925,6 +928,8 @@ static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
        /* Kick the lance: transmit now */
        writereg(&ll->rdp, LE_C0_INEA | LE_C0_TDMD);
 
+       spin_unlock_irqrestore(&lp->lock, flags);
+
        dev->trans_start = jiffies;
        dev_kfree_skb(skb);