[netdrvr pcnet32] bug fixes

I would like to see a couple of the pcnet32 changes that I think we can
agree on be put into the trees so a couple of the potential defects can be
avoided.  The following patch contains just these pieces.  The only
controversial one is an arbitrary change in the number of iterations in a
while loop spinning on hardware state.   No matter how this is done, I am
not especially fond of this bit of code as it has no reasonable error
recovery path -- however, as a half-way, incremental solution, increasing
the polling time should help as the 100 value was certainly found to be
insufficient.  1000 may not be sufficient either, but it is certainly no
worse.

Both of the other changes were hit in testing (and I belive the wmb() at a
customer even), so it would help reduce some debug if these go in.  Any
feedback is appreciated - thanks.

drivers/net/pcnet32.c

@@ -1002,6 +1002,8 @@ pcnet32_init_ring(struct net_device *dev)
 	    }
 	    skb_reserve (rx_skbuff, 2);
 	}
+
+	if (lp->rx_dma_addr[i] == NULL) 
 		lp->rx_dma_addr[i] = pci_map_single(lp->pci_dev, rx_skbuff->tail, rx_skbuff->len, PCI_DMA_FROMDEVICE);
 	lp->rx_ring[i].base = (u32)le32_to_cpu(lp->rx_dma_addr[i]);
 	lp->rx_ring[i].buf_length = le16_to_cpu(-PKT_BUF_SZ);
@@ -1037,7 +1039,7 @@ pcnet32_restart(struct net_device *dev, unsigned int csr0_bits)
     /* ReInit Ring */
     lp->a.write_csr (ioaddr, 0, 1);
     i = 0;
-    while (i++ < 100)
+    while (i++ < 1000)
 	if (lp->a.read_csr (ioaddr, 0) & 0x0100)
 	    break;
 
@@ -1128,6 +1130,7 @@ pcnet32_start_xmit(struct sk_buff *skb, struct net_device *dev)
     lp->tx_skbuff[entry] = skb;
     lp->tx_dma_addr[entry] = pci_map_single(lp->pci_dev, skb->data, skb->len, PCI_DMA_TODEVICE);
     lp->tx_ring[entry].base = (u32)le32_to_cpu(lp->tx_dma_addr[entry]);
+    wmb(); /* Make sure owner changes after all others are visible */
     lp->tx_ring[entry].status = le16_to_cpu(status);
 
     lp->cur_tx++;