1 files changed, 89 insertions, 60 deletions

diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 467d41698fd5..585e90f8341d 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -171,34 +171,67 @@ static struct mdiobb_ops bb_ops = {
         .get_mdio_data = ravb_get_mdio_data,
 };
 
-/* Free skb's and DMA buffers for Ethernet AVB */
-static void ravb_ring_free(struct net_device *ndev, int q)
+/* Free TX skb function for AVB-IP */
+static int ravb_tx_free(struct net_device *ndev, int q, bool free_txed_only)
 {
         struct ravb_private *priv = netdev_priv(ndev);
-        int ring_size;
-        int i;
+        struct net_device_stats *stats = &priv->stats[q];
+        struct ravb_tx_desc *desc;
+        int free_num = 0;
+        int entry;
+        u32 size;
 
-        /* Free RX skb ringbuffer */
-        if (priv->rx_skb[q]) {
-                for (i = 0; i < priv->num_rx_ring[q]; i++)
-                        dev_kfree_skb(priv->rx_skb[q][i]);
-        }
-        kfree(priv->rx_skb[q]);
-        priv->rx_skb[q] = NULL;
+        for (; priv->cur_tx[q] - priv->dirty_tx[q] > 0; priv->dirty_tx[q]++) {
+                bool txed;
 
-        /* Free TX skb ringbuffer */
-        if (priv->tx_skb[q]) {
-                for (i = 0; i < priv->num_tx_ring[q]; i++)
-                        dev_kfree_skb(priv->tx_skb[q][i]);
+                entry = priv->dirty_tx[q] % (priv->num_tx_ring[q] *
+                                             NUM_TX_DESC);
+                desc = &priv->tx_ring[q][entry];
+                txed = desc->die_dt == DT_FEMPTY;
+                if (free_txed_only && !txed)
+                        break;
+                /* Descriptor type must be checked before all other reads */
+                dma_rmb();
+                size = le16_to_cpu(desc->ds_tagl) & TX_DS;
+                /* Free the original skb. */
+                if (priv->tx_skb[q][entry / NUM_TX_DESC]) {
+                        dma_unmap_single(ndev->dev.parent, le32_to_cpu(desc->dptr),
+                                         size, DMA_TO_DEVICE);
+                        /* Last packet descriptor? */
+                        if (entry % NUM_TX_DESC == NUM_TX_DESC - 1) {
+                                entry /= NUM_TX_DESC;
+                                dev_kfree_skb_any(priv->tx_skb[q][entry]);
+                                priv->tx_skb[q][entry] = NULL;
+                                if (txed)
+                                        stats->tx_packets++;
+                        }
+                        free_num++;
+                }
+                if (txed)
+                        stats->tx_bytes += size;
+                desc->die_dt = DT_EEMPTY;
         }
-        kfree(priv->tx_skb[q]);
-        priv->tx_skb[q] = NULL;
+        return free_num;
+}
 
-        /* Free aligned TX buffers */
-        kfree(priv->tx_align[q]);
-        priv->tx_align[q] = NULL;
+/* Free skb's and DMA buffers for Ethernet AVB */
+static void ravb_ring_free(struct net_device *ndev, int q)
+{
+        struct ravb_private *priv = netdev_priv(ndev);
+        int ring_size;
+        int i;
 
         if (priv->rx_ring[q]) {
+                for (i = 0; i < priv->num_rx_ring[q]; i++) {
+                        struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i];
+
+                        if (!dma_mapping_error(ndev->dev.parent,
+                                               le32_to_cpu(desc->dptr)))
+                                dma_unmap_single(ndev->dev.parent,
+                                                 le32_to_cpu(desc->dptr),
+                                                 PKT_BUF_SZ,
+                                                 DMA_FROM_DEVICE);
+                }
                 ring_size = sizeof(struct ravb_ex_rx_desc) *
                             (priv->num_rx_ring[q] + 1);
                 dma_free_coherent(ndev->dev.parent, ring_size, priv->rx_ring[q],
@@ -207,12 +240,32 @@ static void ravb_ring_free(struct net_device *ndev, int q)
         }
 
         if (priv->tx_ring[q]) {
+                ravb_tx_free(ndev, q, false);
+
                 ring_size = sizeof(struct ravb_tx_desc) *
                             (priv->num_tx_ring[q] * NUM_TX_DESC + 1);
                 dma_free_coherent(ndev->dev.parent, ring_size, priv->tx_ring[q],
                                   priv->tx_desc_dma[q]);
                 priv->tx_ring[q] = NULL;
         }
+
+        /* Free RX skb ringbuffer */
+        if (priv->rx_skb[q]) {
+                for (i = 0; i < priv->num_rx_ring[q]; i++)
+                        dev_kfree_skb(priv->rx_skb[q][i]);
+        }
+        kfree(priv->rx_skb[q]);
+        priv->rx_skb[q] = NULL;
+
+        /* Free aligned TX buffers */
+        kfree(priv->tx_align[q]);
+        priv->tx_align[q] = NULL;
+
+        /* Free TX skb ringbuffer.
+         * SKBs are freed by ravb_tx_free() call above.
+         */
+        kfree(priv->tx_skb[q]);
+        priv->tx_skb[q] = NULL;
 }
 
 /* Format skb and descriptor buffer for Ethernet AVB */
@@ -420,44 +473,6 @@ static int ravb_dmac_init(struct net_device *ndev)
         return 0;
 }
 
-/* Free TX skb function for AVB-IP */
-static int ravb_tx_free(struct net_device *ndev, int q)
-{
-        struct ravb_private *priv = netdev_priv(ndev);
-        struct net_device_stats *stats = &priv->stats[q];
-        struct ravb_tx_desc *desc;
-        int free_num = 0;
-        int entry;
-        u32 size;
-
-        for (; priv->cur_tx[q] - priv->dirty_tx[q] > 0; priv->dirty_tx[q]++) {
-                entry = priv->dirty_tx[q] % (priv->num_tx_ring[q] *
-                                             NUM_TX_DESC);
-                desc = &priv->tx_ring[q][entry];
-                if (desc->die_dt != DT_FEMPTY)
-                        break;
-                /* Descriptor type must be checked before all other reads */
-                dma_rmb();
-                size = le16_to_cpu(desc->ds_tagl) & TX_DS;
-                /* Free the original skb. */
-                if (priv->tx_skb[q][entry / NUM_TX_DESC]) {
-                        dma_unmap_single(ndev->dev.parent, le32_to_cpu(desc->dptr),
-                                         size, DMA_TO_DEVICE);
-                        /* Last packet descriptor? */
-                        if (entry % NUM_TX_DESC == NUM_TX_DESC - 1) {
-                                entry /= NUM_TX_DESC;
-                                dev_kfree_skb_any(priv->tx_skb[q][entry]);
-                                priv->tx_skb[q][entry] = NULL;
-                                stats->tx_packets++;
-                        }
-                        free_num++;
-                }
-                stats->tx_bytes += size;
-                desc->die_dt = DT_EEMPTY;
-        }
-        return free_num;
-}
-
 static void ravb_get_tx_tstamp(struct net_device *ndev)
 {
         struct ravb_private *priv = netdev_priv(ndev);
@@ -797,7 +812,7 @@ static int ravb_poll(struct napi_struct *napi, int budget)
                         spin_lock_irqsave(&priv->lock, flags);
                         /* Clear TX interrupt */
                         ravb_write(ndev, ~mask, TIS);
-                        ravb_tx_free(ndev, q);
+                        ravb_tx_free(ndev, q, true);
                         netif_wake_subqueue(ndev, q);
                         mmiowb();
                         spin_unlock_irqrestore(&priv->lock, flags);
@@ -1330,6 +1345,19 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         buffer = PTR_ALIGN(priv->tx_align[q], DPTR_ALIGN) +
                  entry / NUM_TX_DESC * DPTR_ALIGN;
         len = PTR_ALIGN(skb->data, DPTR_ALIGN) - skb->data;
+        /* Zero length DMA descriptors are problematic as they seem to
+         * terminate DMA transfers. Avoid them by simply using a length of
+         * DPTR_ALIGN (4) when skb data is aligned to DPTR_ALIGN.
+         *
+         * As skb is guaranteed to have at least ETH_ZLEN (60) bytes of
+         * data by the call to skb_put_padto() above this is safe with
+         * respect to both the length of the first DMA descriptor (len)
+         * overflowing the available data and the length of the second DMA
+         * descriptor (skb->len - len) being negative.
+         */
+        if (len == 0)
+                len = DPTR_ALIGN;
+
         memcpy(buffer, skb->data, len);
         dma_addr = dma_map_single(ndev->dev.parent, buffer, len, DMA_TO_DEVICE);
         if (dma_mapping_error(ndev->dev.parent, dma_addr))
@@ -1380,7 +1408,8 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 
         priv->cur_tx[q] += NUM_TX_DESC;
         if (priv->cur_tx[q] - priv->dirty_tx[q] >
-            (priv->num_tx_ring[q] - 1) * NUM_TX_DESC && !ravb_tx_free(ndev, q))
+            (priv->num_tx_ring[q] - 1) * NUM_TX_DESC &&
+            !ravb_tx_free(ndev, q, true))
                 netif_stop_subqueue(ndev, q);
 
 exit: