From c3cb2a874122889c036934294dbbb8ad82f53060 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Mon, 20 Feb 2012 23:22:02 +0000 Subject: sfc: Specify that the VFDI status page has page alignment and size This requirement was meant to be implied in the name 'status page'. One out-of-tree VF driver allocates a buffer using the structure size and not a full page - hence the current odd specification - but in practice that allocation will be padded and aligned to at least 4KB. Therefore, we can specify this and have the option to extend the structure up to 4KB without worrying about VF drivers using odd-shaped buffers. Signed-off-by: Ben Hutchings --- drivers/net/ethernet/sfc/vfdi.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/sfc/vfdi.h b/drivers/net/ethernet/sfc/vfdi.h index 656fa70f999..225557caaf5 100644 --- a/drivers/net/ethernet/sfc/vfdi.h +++ b/drivers/net/ethernet/sfc/vfdi.h @@ -152,7 +152,8 @@ enum vfdi_op { * all traffic at this receive queue. * @u.mac_filter.flags: MAC filter flags. * @u.set_status_page.dma_addr: Base address for the &struct vfdi_status. - * This address must be such that the structure fits within a page. + * This address must be page-aligned and the PF may write up to a + * whole page (allowing for extension of the structure). * @u.set_status_page.peer_page_count: Number of additional pages the VF * has provided into which peer addresses may be DMAd. * @u.set_status_page.peer_page_addr: Array of DMA addresses of pages. -- cgit v1.2.3-70-g09d2 From 01cb543db8a2d2dbcea5f357365ce1327ac46193 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Tue, 21 Feb 2012 02:57:33 +0000 Subject: sfc: Correct validation of peer_page_count in efx_vfdi_set_status_page() efx_vfdi_set_status_page() validates the peer page count by calculating the size of a request containing that many addresses and comparing that with the maximum valid request size (4KB). The calculation involves a multiplication that may overflow on a 32-bit system. We use kcalloc() to allocate memory to store the addresses; that also does a multiplication and it does check for integer overflow, so any values larger than 0x1fffffff will be rejected. However, values in the range [0x1fffffffc, 0x1fffffff] pass boh tests and result in an attempt to allocate nearly 4GB on the heap. This should be rejected rather quickly as it's obviously impossible on a 32-bit system, and indeed the maximum possible heap allocation is 32MB. Still, let's make absolutely sure by fixing the initial validation. Signed-off-by: Ben Hutchings --- drivers/net/ethernet/sfc/siena_sriov.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/sfc/siena_sriov.c b/drivers/net/ethernet/sfc/siena_sriov.c index 5c6839ec3a8..80976e84eee 100644 --- a/drivers/net/ethernet/sfc/siena_sriov.c +++ b/drivers/net/ethernet/sfc/siena_sriov.c @@ -796,12 +796,13 @@ static int efx_vfdi_set_status_page(struct efx_vf *vf) { struct efx_nic *efx = vf->efx; struct vfdi_req *req = vf->buf.addr; - unsigned int page_count; + u64 page_count = req->u.set_status_page.peer_page_count; + u64 max_page_count = + (EFX_PAGE_SIZE - + offsetof(struct vfdi_req, u.set_status_page.peer_page_addr[0])) + / sizeof(req->u.set_status_page.peer_page_addr[0]); - page_count = req->u.set_status_page.peer_page_count; - if (!req->u.set_status_page.dma_addr || EFX_PAGE_SIZE < - offsetof(struct vfdi_req, - u.set_status_page.peer_page_addr[page_count])) { + if (!req->u.set_status_page.dma_addr || page_count > max_page_count) { if (net_ratelimit()) netif_err(efx, hw, efx->net_dev, "ERROR: Invalid SET_STATUS_PAGE from %s\n", -- cgit v1.2.3-70-g09d2 From c92aaff18e0a48f693678105343160e0bd032dfa Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Tue, 21 Feb 2012 23:22:00 +0000 Subject: sfc: Reverse initial buffer table allocation to allow for later resizing We have a very simple way of allocating buffer table entries to queues, which is just to take the next one available. The extra channels are the highest numbered channels but they need to be allocated the lowest entries so that the traffic channels can be allocated new entries without any collisions. Signed-off-by: Ben Hutchings --- drivers/net/ethernet/sfc/efx.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c index ac571cf1448..c7004dcb583 100644 --- a/drivers/net/ethernet/sfc/efx.c +++ b/drivers/net/ethernet/sfc/efx.c @@ -585,7 +585,12 @@ static int efx_probe_channels(struct efx_nic *efx) /* Restart special buffer allocation */ efx->next_buffer_table = 0; - efx_for_each_channel(channel, efx) { + /* Probe channels in reverse, so that any 'extra' channels + * use the start of the buffer table. This allows the traffic + * channels to be resized without moving them or wasting the + * entries before them. + */ + efx_for_each_channel_rev(channel, efx) { rc = efx_probe_channel(channel); if (rc) { netif_err(efx, probe, efx->net_dev, -- cgit v1.2.3-70-g09d2 From 2d0cc56da39d62e141d4a60e3ac96522c52de4b1 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Fri, 17 Feb 2012 00:10:45 +0000 Subject: sfc: Minor formatting cleanup Fix some indentation and line continuations. Signed-off-by: Ben Hutchings --- drivers/net/ethernet/sfc/bitfield.h | 4 ++-- drivers/net/ethernet/sfc/mcdi_mon.c | 2 +- drivers/net/ethernet/sfc/tx.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/sfc/bitfield.h b/drivers/net/ethernet/sfc/bitfield.h index a2a9f40b90c..b26a954c27f 100644 --- a/drivers/net/ethernet/sfc/bitfield.h +++ b/drivers/net/ethernet/sfc/bitfield.h @@ -531,8 +531,8 @@ typedef union efx_oword { /* Static initialiser */ -#define EFX_OWORD32(a, b, c, d) \ - { .u32 = { cpu_to_le32(a), cpu_to_le32(b), \ +#define EFX_OWORD32(a, b, c, d) \ + { .u32 = { cpu_to_le32(a), cpu_to_le32(b), \ cpu_to_le32(c), cpu_to_le32(d) } } #endif /* EFX_BITFIELD_H */ diff --git a/drivers/net/ethernet/sfc/mcdi_mon.c b/drivers/net/ethernet/sfc/mcdi_mon.c index 8a72c10b9a6..fb7f65b59eb 100644 --- a/drivers/net/ethernet/sfc/mcdi_mon.c +++ b/drivers/net/ethernet/sfc/mcdi_mon.c @@ -37,7 +37,7 @@ static const struct { SENSOR(PHY0_TEMP, "PHY temp.", EFX_HWMON_TEMP, 0), SENSOR(PHY0_COOLING, "PHY cooling", EFX_HWMON_COOL, 0), SENSOR(PHY1_TEMP, "PHY temp.", EFX_HWMON_TEMP, 1), - SENSOR(PHY1_COOLING, "PHY cooling", EFX_HWMON_COOL, 1), + SENSOR(PHY1_COOLING, "PHY cooling", EFX_HWMON_COOL, 1), SENSOR(IN_1V0, "1.0V supply", EFX_HWMON_IN, -1), SENSOR(IN_1V2, "1.2V supply", EFX_HWMON_IN, -1), SENSOR(IN_1V8, "1.8V supply", EFX_HWMON_IN, -1), diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c index a096e287e95..94d0365b31c 100644 --- a/drivers/net/ethernet/sfc/tx.c +++ b/drivers/net/ethernet/sfc/tx.c @@ -339,7 +339,7 @@ static void efx_dequeue_buffers(struct efx_tx_queue *tx_queue, * OS to free the skb. */ netdev_tx_t efx_hard_start_xmit(struct sk_buff *skb, - struct net_device *net_dev) + struct net_device *net_dev) { struct efx_nic *efx = netdev_priv(net_dev); struct efx_tx_queue *tx_queue; -- cgit v1.2.3-70-g09d2 From 73e0026fb2bee4f2ca85c702040e143ec504eaa6 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Thu, 23 Feb 2012 00:45:50 +0000 Subject: sfc: Correct efx_for_each_possible_channel_tx_queue() to skip non-TX channels efx_for_each_possible_channel_tx_queue() should do nothing for RX-only or extra channels. The current definition results in allocating additional unused hardware TX queues when using the mqprio qdisc and either separate_tx_channels or SR-IOV. Signed-off-by: Ben Hutchings --- drivers/net/ethernet/sfc/net_driver.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h index 3fbec458c32..0b95505e896 100644 --- a/drivers/net/ethernet/sfc/net_driver.h +++ b/drivers/net/ethernet/sfc/net_driver.h @@ -1030,9 +1030,12 @@ static inline bool efx_tx_queue_used(struct efx_tx_queue *tx_queue) /* Iterate over all possible TX queues belonging to a channel */ #define efx_for_each_possible_channel_tx_queue(_tx_queue, _channel) \ - for (_tx_queue = (_channel)->tx_queue; \ - _tx_queue < (_channel)->tx_queue + EFX_TXQ_TYPES; \ - _tx_queue++) + if (!efx_channel_has_tx_queues(_channel)) \ + ; \ + else \ + for (_tx_queue = (_channel)->tx_queue; \ + _tx_queue < (_channel)->tx_queue + EFX_TXQ_TYPES; \ + _tx_queue++) static inline bool efx_channel_has_rx_queue(struct efx_channel *channel) { -- cgit v1.2.3-70-g09d2