Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

===================================================================
RCS file: /ftp/cvs/cvsroot/src/sys/arch/xen/xen/if_xennet_xenbus.c,v
rcsdiff: /ftp/cvs/cvsroot/src/sys/arch/xen/xen/if_xennet_xenbus.c,v: warning: Unknown phrases like `commitid ...;' are present.
retrieving revision 1.7
retrieving revision 1.7.2.5
diff -u -p -r1.7 -r1.7.2.5
--- src/sys/arch/xen/xen/if_xennet_xenbus.c	2006/04/02 17:11:12	1.7
+++ src/sys/arch/xen/xen/if_xennet_xenbus.c	2006/08/05 15:59:57	1.7.2.5
@@ -1,4 +1,4 @@
-/*      $NetBSD: if_xennet_xenbus.c,v 1.7 2006/04/02 17:11:12 bouyer Exp $      */
+/*      $NetBSD: if_xennet_xenbus.c,v 1.7.2.5 2006/08/05 15:59:57 ghen Exp $      */
 
 /*
  * Copyright (c) 2006 Manuel Bouyer.
@@ -61,7 +61,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_xennet_xenbus.c,v 1.7 2006/04/02 17:11:12 bouyer Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_xennet_xenbus.c,v 1.7.2.5 2006/08/05 15:59:57 ghen Exp $");
 
 #include "opt_xen.h"
 #include "opt_nfs_boot.h"
@@ -277,8 +277,8 @@ xennet_xenbus_attach(struct device *pare
 		struct xennet_rxreq *rxreq = &sc->sc_rxreqs[i];
 		rxreq->rxreq_id = i;
 		rxreq->rxreq_sc = sc;
-		rxreq->rxreq_va = uvm_km_alloc(kernel_map,
-		    PAGE_SIZE, PAGE_SIZE, UVM_KMF_WIRED | UVM_KMF_ZERO);
+		rxreq->rxreq_va = uvm_km_zalloc(kernel_map,
+		    PAGE_SIZE);
 		if (rxreq->rxreq_va == 0)
 			break;
 		if (!pmap_extract(pmap_kernel(), rxreq->rxreq_va,
@@ -360,8 +360,7 @@ xennet_xenbus_detach(struct device *self
 	s1 = splvm();
 	for (i = 0; i < NET_RX_RING_SIZE; i++) {
 		struct xennet_rxreq *rxreq = &sc->sc_rxreqs[i];
-		uvm_km_free(kernel_map, rxreq->rxreq_va, PAGE_SIZE,
-		    UVM_KMF_WIRED);
+		uvm_km_free(kernel_map, rxreq->rxreq_va, PAGE_SIZE);
 	}
 	splx(s1);
 		
@@ -371,14 +370,12 @@ xennet_xenbus_detach(struct device *self
 		tsleep(xennet_xenbus_detach, PRIBIO, "xnet_txref", hz/2);
 	}
 	xengnt_revoke_access(sc->sc_tx_ring_gntref);
-	uvm_km_free(kernel_map, (vaddr_t)sc->sc_tx_ring.sring, PAGE_SIZE,
-	    UVM_KMF_WIRED);
+	uvm_km_free(kernel_map, (vaddr_t)sc->sc_tx_ring.sring, PAGE_SIZE);
 	while (xengnt_status(sc->sc_rx_ring_gntref)) {
 		tsleep(xennet_xenbus_detach, PRIBIO, "xnet_rxref", hz/2);
 	}
 	xengnt_revoke_access(sc->sc_rx_ring_gntref);
-	uvm_km_free(kernel_map, (vaddr_t)sc->sc_rx_ring.sring, PAGE_SIZE,
-	    UVM_KMF_WIRED);
+	uvm_km_free(kernel_map, (vaddr_t)sc->sc_rx_ring.sring, PAGE_SIZE);
 	softintr_disestablish(sc->sc_softintr);
 	event_remove_handler(sc->sc_evtchn, &xennet_handler, sc);
 	splx(s0);
@@ -402,10 +399,8 @@ xennet_xenbus_resume(void *p)
 
 
 	/* setup device: alloc event channel and shared rings */
-	tx_ring = (void *)uvm_km_alloc(kernel_map, PAGE_SIZE, 0,
-	     UVM_KMF_WIRED | UVM_KMF_ZERO);
-	rx_ring = (void *)uvm_km_alloc(kernel_map, PAGE_SIZE, 0,
-	    UVM_KMF_WIRED | UVM_KMF_ZERO);
+	tx_ring = (void *)uvm_km_zalloc(kernel_map, PAGE_SIZE);
+	rx_ring = (void *)uvm_km_zalloc(kernel_map, PAGE_SIZE);
 	if (tx_ring == NULL || rx_ring == NULL)
 		panic("xennet_xenbus_resume: can't alloc rings");
 
@@ -481,16 +476,17 @@ static void xennet_backend_changed(struc
 	DPRINTF(("%s: new backend state %d\n", sc->sc_dev.dv_xname, new_state));
 
 	switch (new_state) {
-	case XenbusStateUnknown:
 	case XenbusStateInitialising:
 	case XenbusStateInitWait:
 	case XenbusStateInitialised:
+		break;
 	case XenbusStateClosing:
 		sc->sc_backend_status = BEST_CLOSED;
 		xenbus_switch_state(sc->sc_xbusd, NULL, XenbusStateClosed);
 		break;
 	case XenbusStateConnected:
 		break;
+	case XenbusStateUnknown:
 	default:
 		panic("bad backend state %d", new_state);
 	}
@@ -510,6 +506,7 @@ xennet_alloc_rx_buffer(struct xennet_xen
 	for (i = 0; sc->sc_free_rxreql != 0; i++) {
 		req  = SLIST_FIRST(&sc->sc_rxreq_head);
 		KASSERT(req != NULL);
+		KASSERT(req == &sc->sc_rxreqs[req->rxreq_id]);
 		RING_GET_REQUEST(&sc->sc_rx_ring, req_prod + i)->id =
 		    req->rxreq_id;
 		if (xengnt_grant_transfer(sc->sc_xbusd->xbusd_otherend_id,
@@ -624,7 +621,7 @@ xennet_free_rx_buffer(struct xennet_xenb
 			mmu[0].ptr = (ma << PAGE_SHIFT) | MMU_MACHPHYS_UPDATE;
 			mmu[0].val = ((pa - XPMAP_OFFSET) >> PAGE_SHIFT);
 			MULTI_update_va_mapping(&mcl[0], va, 
-			    (ma << PAGE_SHIFT) | PG_V | PG_KW,
+			    (ma << PAGE_SHIFT) | PG_V | PG_KW | PG_PVLIST,
 			    UVMF_TLB_FLUSH|UVMF_ALL);
 			xpmap_phys_to_machine_mapping[
 			    (pa - XPMAP_OFFSET) >> PAGE_SHIFT] = ma;
@@ -647,6 +644,8 @@ xennet_rx_mbuf_free(struct mbuf *m, cadd
 	struct xennet_rxreq *req = arg;
 	struct xennet_xenbus_softc *sc = req->rxreq_sc;
 
+	int s = splnet();
+
 	SLIST_INSERT_HEAD(&sc->sc_rxreq_head, req, rxreq_next);
 	sc->sc_free_rxreql++;
 
@@ -658,6 +657,7 @@ xennet_rx_mbuf_free(struct mbuf *m, cadd
 
 	if (m)
 		pool_cache_put(&mbpool_cache, m);
+	splx(s);
 }
 
 
@@ -739,6 +739,7 @@ again:
 		netif_rx_response_t *rx = RING_GET_RESPONSE(&sc->sc_rx_ring, i);
 		req = &sc->sc_rxreqs[rx->id];
 		KASSERT(req->rxreq_gntref != GRANT_INVALID_REF);
+		KASSERT(req->rxreq_id == rx->id);
 		ma = xengnt_revoke_transfer(req->rxreq_gntref);
 		if (ma == 0) {
 			/*
@@ -764,7 +765,8 @@ again:
 		mmu[0].ptr = (ma << PAGE_SHIFT) | MMU_MACHPHYS_UPDATE;
 		mmu[0].val = ((pa - XPMAP_OFFSET) >> PAGE_SHIFT);
 		MULTI_update_va_mapping(&mcl[0], va, 
-		    (ma << PAGE_SHIFT) | PG_V | PG_KW, UVMF_TLB_FLUSH|UVMF_ALL);
+		    (ma << PAGE_SHIFT) | PG_V | PG_KW | PG_PVLIST,
+		    UVMF_TLB_FLUSH|UVMF_ALL);
 		xpmap_phys_to_machine_mapping[
 		    (pa - XPMAP_OFFSET) >> PAGE_SHIFT] = ma;
 		mcl[1].op = __HYPERVISOR_mmu_update;
@@ -795,6 +797,7 @@ again:
 			xennet_rx_mbuf_free(NULL, (void *)va, PAGE_SIZE, req);
 			continue;
 		}
+		MCLAIM(m, &sc->sc_ethercom.ec_rx_mowner);
 
 		m->m_pkthdr.rcvif = ifp;
 		if (__predict_true(sc->sc_rx_ring.req_prod_pvt != 
@@ -802,6 +805,7 @@ again:
 			m->m_len = m->m_pkthdr.len = rx->status;
 			MEXTADD(m, pktp, rx->status,
 			    M_DEVBUF, xennet_rx_mbuf_free, req);
+			m->m_flags |= M_EXT_RW; /* we own the buffer */
 			req->rxreq_gntref = GRANT_STACK_REF;
 		} else {
 			/*
@@ -809,7 +813,7 @@ again:
 			 * memory, copy data and push the receive
 			 * buffer back to the hypervisor.
 			 */
-			m->m_len = MHLEN;
+			m->m_len = min(MHLEN, rx->status);
 			m->m_pkthdr.len = 0;
 			m_copyback(m, 0, rx->status, pktp);
 			xennet_rx_mbuf_free(NULL, (void *)va, PAGE_SIZE, req);
@@ -981,6 +985,7 @@ xennet_softstart(void *arg)
 			/* we will be able to send m */
 			IFQ_DEQUEUE(&ifp->if_snd, m);
 		}
+		MCLAIM(m, &sc->sc_ethercom.ec_tx_mowner);
 
 		KASSERT(((pa ^ (pa + m->m_pkthdr.len -  1)) & PG_FRAME) == 0);