On Sat, Jan 30, 2016 at 10:49:38PM +1300, Richard Procter wrote: > - ring->queued--; > + atomic_dec_int(&ring->queued);
> - ring->queued += ntxds; > + atomic_add_int(&ring->queued, ntxds); I don't think these make a difference in the current way of things. Wireless drivers run interrupts under the kernel big lock, interrupts aren't preemptible, and AFAIK (most?) 32bit integer operations are atomic. > * fix dropped frames, watchdog timeouts. > > - on full tx ring, ring->cur wraps to an active tx descriptor. Passing > that wrapped value to the card was observed to cause general flakiness. Nice find. > * replace custom defrag with m_defrag() Also good. We've already done this in some other drivers. > + /* XXX card may interrupt here and invalidate this guard; the You can easily prevent the card from interrupting by making rt2860_tx() call splnet() before modifying data shared with the interrupt handler. I think that's the real bug you're looking for. Could you try that and send an updated diff if it works? Thank you very much for your work on this. I wrote some fixes for the rt2560 line of ral chips some years ago fixing similar driver bugs.