mlx4_en: Fix read buffer overflow in mlx4_en_complete_rx_desc()
[linux-2.6.git] / drivers / net / mlx4 / en_rx.c
1 /*
2  * Copyright (c) 2007 Mellanox Technologies. All rights reserved.
3  *
4  * This software is available to you under a choice of one of two
5  * licenses.  You may choose to be licensed under the terms of the GNU
6  * General Public License (GPL) Version 2, available from the file
7  * COPYING in the main directory of this source tree, or the
8  * OpenIB.org BSD license below:
9  *
10  *     Redistribution and use in source and binary forms, with or
11  *     without modification, are permitted provided that the following
12  *     conditions are met:
13  *
14  *      - Redistributions of source code must retain the above
15  *        copyright notice, this list of conditions and the following
16  *        disclaimer.
17  *
18  *      - Redistributions in binary form must reproduce the above
19  *        copyright notice, this list of conditions and the following
20  *        disclaimer in the documentation and/or other materials
21  *        provided with the distribution.
22  *
23  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
26  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
27  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
28  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
29  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
30  * SOFTWARE.
31  *
32  */
33
34 #include <linux/mlx4/cq.h>
35 #include <linux/mlx4/qp.h>
36 #include <linux/skbuff.h>
37 #include <linux/if_ether.h>
38 #include <linux/if_vlan.h>
39 #include <linux/vmalloc.h>
40
41 #include "mlx4_en.h"
42
43 static void *get_wqe(struct mlx4_en_rx_ring *ring, int n)
44 {
45         int offset = n << ring->srq.wqe_shift;
46         return ring->buf + offset;
47 }
48
49 static void mlx4_en_srq_event(struct mlx4_srq *srq, enum mlx4_event type)
50 {
51         return;
52 }
53
54 static int mlx4_en_get_frag_header(struct skb_frag_struct *frags, void **mac_hdr,
55                                    void **ip_hdr, void **tcpudp_hdr,
56                                    u64 *hdr_flags, void *priv)
57 {
58         *mac_hdr = page_address(frags->page) + frags->page_offset;
59         *ip_hdr = *mac_hdr + ETH_HLEN;
60         *tcpudp_hdr = (struct tcphdr *)(*ip_hdr + sizeof(struct iphdr));
61         *hdr_flags = LRO_IPV4 | LRO_TCP;
62
63         return 0;
64 }
65
66 static int mlx4_en_alloc_frag(struct mlx4_en_priv *priv,
67                               struct mlx4_en_rx_desc *rx_desc,
68                               struct skb_frag_struct *skb_frags,
69                               struct mlx4_en_rx_alloc *ring_alloc,
70                               int i)
71 {
72         struct mlx4_en_dev *mdev = priv->mdev;
73         struct mlx4_en_frag_info *frag_info = &priv->frag_info[i];
74         struct mlx4_en_rx_alloc *page_alloc = &ring_alloc[i];
75         struct page *page;
76         dma_addr_t dma;
77
78         if (page_alloc->offset == frag_info->last_offset) {
79                 /* Allocate new page */
80                 page = alloc_pages(GFP_ATOMIC | __GFP_COMP, MLX4_EN_ALLOC_ORDER);
81                 if (!page)
82                         return -ENOMEM;
83
84                 skb_frags[i].page = page_alloc->page;
85                 skb_frags[i].page_offset = page_alloc->offset;
86                 page_alloc->page = page;
87                 page_alloc->offset = frag_info->frag_align;
88         } else {
89                 page = page_alloc->page;
90                 get_page(page);
91
92                 skb_frags[i].page = page;
93                 skb_frags[i].page_offset = page_alloc->offset;
94                 page_alloc->offset += frag_info->frag_stride;
95         }
96         dma = pci_map_single(mdev->pdev, page_address(skb_frags[i].page) +
97                              skb_frags[i].page_offset, frag_info->frag_size,
98                              PCI_DMA_FROMDEVICE);
99         rx_desc->data[i].addr = cpu_to_be64(dma);
100         return 0;
101 }
102
103 static int mlx4_en_init_allocator(struct mlx4_en_priv *priv,
104                                   struct mlx4_en_rx_ring *ring)
105 {
106         struct mlx4_en_rx_alloc *page_alloc;
107         int i;
108
109         for (i = 0; i < priv->num_frags; i++) {
110                 page_alloc = &ring->page_alloc[i];
111                 page_alloc->page = alloc_pages(GFP_ATOMIC | __GFP_COMP,
112                                                MLX4_EN_ALLOC_ORDER);
113                 if (!page_alloc->page)
114                         goto out;
115
116                 page_alloc->offset = priv->frag_info[i].frag_align;
117                 en_dbg(DRV, priv, "Initialized allocator:%d with page:%p\n",
118                        i, page_alloc->page);
119         }
120         return 0;
121
122 out:
123         while (i--) {
124                 page_alloc = &ring->page_alloc[i];
125                 put_page(page_alloc->page);
126                 page_alloc->page = NULL;
127         }
128         return -ENOMEM;
129 }
130
131 static void mlx4_en_destroy_allocator(struct mlx4_en_priv *priv,
132                                       struct mlx4_en_rx_ring *ring)
133 {
134         struct mlx4_en_rx_alloc *page_alloc;
135         int i;
136
137         for (i = 0; i < priv->num_frags; i++) {
138                 page_alloc = &ring->page_alloc[i];
139                 en_dbg(DRV, priv, "Freeing allocator:%d count:%d\n",
140                        i, page_count(page_alloc->page));
141
142                 put_page(page_alloc->page);
143                 page_alloc->page = NULL;
144         }
145 }
146
147
148 static void mlx4_en_init_rx_desc(struct mlx4_en_priv *priv,
149                                  struct mlx4_en_rx_ring *ring, int index)
150 {
151         struct mlx4_en_rx_desc *rx_desc = ring->buf + ring->stride * index;
152         struct skb_frag_struct *skb_frags = ring->rx_info +
153                                             (index << priv->log_rx_info);
154         int possible_frags;
155         int i;
156
157         /* Pre-link descriptor */
158         rx_desc->next.next_wqe_index = cpu_to_be16((index + 1) & ring->size_mask);
159
160         /* Set size and memtype fields */
161         for (i = 0; i < priv->num_frags; i++) {
162                 skb_frags[i].size = priv->frag_info[i].frag_size;
163                 rx_desc->data[i].byte_count =
164                         cpu_to_be32(priv->frag_info[i].frag_size);
165                 rx_desc->data[i].lkey = cpu_to_be32(priv->mdev->mr.key);
166         }
167
168         /* If the number of used fragments does not fill up the ring stride,
169          * remaining (unused) fragments must be padded with null address/size
170          * and a special memory key */
171         possible_frags = (ring->stride - sizeof(struct mlx4_en_rx_desc)) / DS_SIZE;
172         for (i = priv->num_frags; i < possible_frags; i++) {
173                 rx_desc->data[i].byte_count = 0;
174                 rx_desc->data[i].lkey = cpu_to_be32(MLX4_EN_MEMTYPE_PAD);
175                 rx_desc->data[i].addr = 0;
176         }
177 }
178
179
180 static int mlx4_en_prepare_rx_desc(struct mlx4_en_priv *priv,
181                                    struct mlx4_en_rx_ring *ring, int index)
182 {
183         struct mlx4_en_rx_desc *rx_desc = ring->buf + (index * ring->stride);
184         struct skb_frag_struct *skb_frags = ring->rx_info +
185                                             (index << priv->log_rx_info);
186         int i;
187
188         for (i = 0; i < priv->num_frags; i++)
189                 if (mlx4_en_alloc_frag(priv, rx_desc, skb_frags, ring->page_alloc, i))
190                         goto err;
191
192         return 0;
193
194 err:
195         while (i--)
196                 put_page(skb_frags[i].page);
197         return -ENOMEM;
198 }
199
200 static inline void mlx4_en_update_rx_prod_db(struct mlx4_en_rx_ring *ring)
201 {
202         *ring->wqres.db.db = cpu_to_be32(ring->prod & 0xffff);
203 }
204
205 static void mlx4_en_free_rx_desc(struct mlx4_en_priv *priv,
206                                  struct mlx4_en_rx_ring *ring,
207                                  int index)
208 {
209         struct mlx4_en_dev *mdev = priv->mdev;
210         struct skb_frag_struct *skb_frags;
211         struct mlx4_en_rx_desc *rx_desc = ring->buf + (index << ring->log_stride);
212         dma_addr_t dma;
213         int nr;
214
215         skb_frags = ring->rx_info + (index << priv->log_rx_info);
216         for (nr = 0; nr < priv->num_frags; nr++) {
217                 en_dbg(DRV, priv, "Freeing fragment:%d\n", nr);
218                 dma = be64_to_cpu(rx_desc->data[nr].addr);
219
220                 en_dbg(DRV, priv, "Unmaping buffer at dma:0x%llx\n", (u64) dma);
221                 pci_unmap_single(mdev->pdev, dma, skb_frags[nr].size,
222                                  PCI_DMA_FROMDEVICE);
223                 put_page(skb_frags[nr].page);
224         }
225 }
226
227 static int mlx4_en_fill_rx_buffers(struct mlx4_en_priv *priv)
228 {
229         struct mlx4_en_rx_ring *ring;
230         int ring_ind;
231         int buf_ind;
232         int new_size;
233
234         for (buf_ind = 0; buf_ind < priv->prof->rx_ring_size; buf_ind++) {
235                 for (ring_ind = 0; ring_ind < priv->rx_ring_num; ring_ind++) {
236                         ring = &priv->rx_ring[ring_ind];
237
238                         if (mlx4_en_prepare_rx_desc(priv, ring,
239                                                     ring->actual_size)) {
240                                 if (ring->actual_size < MLX4_EN_MIN_RX_SIZE) {
241                                         en_err(priv, "Failed to allocate "
242                                                      "enough rx buffers\n");
243                                         return -ENOMEM;
244                                 } else {
245                                         new_size = rounddown_pow_of_two(ring->actual_size);
246                                         en_warn(priv, "Only %d buffers allocated "
247                                                       "reducing ring size to %d",
248                                                 ring->actual_size, new_size);
249                                         goto reduce_rings;
250                                 }
251                         }
252                         ring->actual_size++;
253                         ring->prod++;
254                 }
255         }
256         return 0;
257
258 reduce_rings:
259         for (ring_ind = 0; ring_ind < priv->rx_ring_num; ring_ind++) {
260                 ring = &priv->rx_ring[ring_ind];
261                 while (ring->actual_size > new_size) {
262                         ring->actual_size--;
263                         ring->prod--;
264                         mlx4_en_free_rx_desc(priv, ring, ring->actual_size);
265                 }
266                 ring->size_mask = ring->actual_size - 1;
267         }
268
269         return 0;
270 }
271
272 static void mlx4_en_free_rx_buf(struct mlx4_en_priv *priv,
273                                 struct mlx4_en_rx_ring *ring)
274 {
275         int index;
276
277         en_dbg(DRV, priv, "Freeing Rx buf - cons:%d prod:%d\n",
278                ring->cons, ring->prod);
279
280         /* Unmap and free Rx buffers */
281         BUG_ON((u32) (ring->prod - ring->cons) > ring->actual_size);
282         while (ring->cons != ring->prod) {
283                 index = ring->cons & ring->size_mask;
284                 en_dbg(DRV, priv, "Processing descriptor:%d\n", index);
285                 mlx4_en_free_rx_desc(priv, ring, index);
286                 ++ring->cons;
287         }
288 }
289
290 int mlx4_en_create_rx_ring(struct mlx4_en_priv *priv,
291                            struct mlx4_en_rx_ring *ring, u32 size, u16 stride)
292 {
293         struct mlx4_en_dev *mdev = priv->mdev;
294         int err;
295         int tmp;
296
297         /* Sanity check SRQ size before proceeding */
298         if (size >= mdev->dev->caps.max_srq_wqes)
299                 return -EINVAL;
300
301         ring->prod = 0;
302         ring->cons = 0;
303         ring->size = size;
304         ring->size_mask = size - 1;
305         ring->stride = stride;
306         ring->log_stride = ffs(ring->stride) - 1;
307         ring->buf_size = ring->size * ring->stride;
308
309         tmp = size * roundup_pow_of_two(MLX4_EN_MAX_RX_FRAGS *
310                                         sizeof(struct skb_frag_struct));
311         ring->rx_info = vmalloc(tmp);
312         if (!ring->rx_info) {
313                 en_err(priv, "Failed allocating rx_info ring\n");
314                 return -ENOMEM;
315         }
316         en_dbg(DRV, priv, "Allocated rx_info ring at addr:%p size:%d\n",
317                  ring->rx_info, tmp);
318
319         err = mlx4_alloc_hwq_res(mdev->dev, &ring->wqres,
320                                  ring->buf_size, 2 * PAGE_SIZE);
321         if (err)
322                 goto err_ring;
323
324         err = mlx4_en_map_buffer(&ring->wqres.buf);
325         if (err) {
326                 en_err(priv, "Failed to map RX buffer\n");
327                 goto err_hwq;
328         }
329         ring->buf = ring->wqres.buf.direct.buf;
330
331         /* Configure lro mngr */
332         memset(&ring->lro, 0, sizeof(struct net_lro_mgr));
333         ring->lro.dev = priv->dev;
334         ring->lro.features = LRO_F_NAPI;
335         ring->lro.frag_align_pad = NET_IP_ALIGN;
336         ring->lro.ip_summed = CHECKSUM_UNNECESSARY;
337         ring->lro.ip_summed_aggr = CHECKSUM_UNNECESSARY;
338         ring->lro.max_desc = mdev->profile.num_lro;
339         ring->lro.max_aggr = MAX_SKB_FRAGS;
340         ring->lro.lro_arr = kzalloc(mdev->profile.num_lro *
341                                     sizeof(struct net_lro_desc),
342                                     GFP_KERNEL);
343         if (!ring->lro.lro_arr) {
344                 en_err(priv, "Failed to allocate lro array\n");
345                 goto err_map;
346         }
347         ring->lro.get_frag_header = mlx4_en_get_frag_header;
348
349         return 0;
350
351 err_map:
352         mlx4_en_unmap_buffer(&ring->wqres.buf);
353 err_hwq:
354         mlx4_free_hwq_res(mdev->dev, &ring->wqres, ring->buf_size);
355 err_ring:
356         vfree(ring->rx_info);
357         ring->rx_info = NULL;
358         return err;
359 }
360
361 int mlx4_en_activate_rx_rings(struct mlx4_en_priv *priv)
362 {
363         struct mlx4_en_dev *mdev = priv->mdev;
364         struct mlx4_wqe_srq_next_seg *next;
365         struct mlx4_en_rx_ring *ring;
366         int i;
367         int ring_ind;
368         int err;
369         int stride = roundup_pow_of_two(sizeof(struct mlx4_en_rx_desc) +
370                                         DS_SIZE * priv->num_frags);
371         int max_gs = (stride - sizeof(struct mlx4_wqe_srq_next_seg)) / DS_SIZE;
372
373         for (ring_ind = 0; ring_ind < priv->rx_ring_num; ring_ind++) {
374                 ring = &priv->rx_ring[ring_ind];
375
376                 ring->prod = 0;
377                 ring->cons = 0;
378                 ring->actual_size = 0;
379                 ring->cqn = priv->rx_cq[ring_ind].mcq.cqn;
380
381                 ring->stride = stride;
382                 ring->log_stride = ffs(ring->stride) - 1;
383                 ring->buf_size = ring->size * ring->stride;
384
385                 memset(ring->buf, 0, ring->buf_size);
386                 mlx4_en_update_rx_prod_db(ring);
387
388                 /* Initailize all descriptors */
389                 for (i = 0; i < ring->size; i++)
390                         mlx4_en_init_rx_desc(priv, ring, i);
391
392                 /* Initialize page allocators */
393                 err = mlx4_en_init_allocator(priv, ring);
394                 if (err) {
395                         en_err(priv, "Failed initializing ring allocator\n");
396                         ring_ind--;
397                         goto err_allocator;
398                 }
399         }
400         err = mlx4_en_fill_rx_buffers(priv);
401         if (err)
402                 goto err_buffers;
403
404         for (ring_ind = 0; ring_ind < priv->rx_ring_num; ring_ind++) {
405                 ring = &priv->rx_ring[ring_ind];
406
407                 mlx4_en_update_rx_prod_db(ring);
408
409                 /* Configure SRQ representing the ring */
410                 ring->srq.max    = ring->actual_size;
411                 ring->srq.max_gs = max_gs;
412                 ring->srq.wqe_shift = ilog2(ring->stride);
413
414                 for (i = 0; i < ring->srq.max; ++i) {
415                         next = get_wqe(ring, i);
416                         next->next_wqe_index =
417                         cpu_to_be16((i + 1) & (ring->srq.max - 1));
418                 }
419
420                 err = mlx4_srq_alloc(mdev->dev, mdev->priv_pdn, &ring->wqres.mtt,
421                                      ring->wqres.db.dma, &ring->srq);
422                 if (err){
423                         en_err(priv, "Failed to allocate srq\n");
424                         ring_ind--;
425                         goto err_srq;
426                 }
427                 ring->srq.event = mlx4_en_srq_event;
428         }
429
430         return 0;
431
432 err_srq:
433         while (ring_ind >= 0) {
434                 ring = &priv->rx_ring[ring_ind];
435                 mlx4_srq_free(mdev->dev, &ring->srq);
436                 ring_ind--;
437         }
438
439 err_buffers:
440         for (ring_ind = 0; ring_ind < priv->rx_ring_num; ring_ind++)
441                 mlx4_en_free_rx_buf(priv, &priv->rx_ring[ring_ind]);
442
443         ring_ind = priv->rx_ring_num - 1;
444 err_allocator:
445         while (ring_ind >= 0) {
446                 mlx4_en_destroy_allocator(priv, &priv->rx_ring[ring_ind]);
447                 ring_ind--;
448         }
449         return err;
450 }
451
452 void mlx4_en_destroy_rx_ring(struct mlx4_en_priv *priv,
453                              struct mlx4_en_rx_ring *ring)
454 {
455         struct mlx4_en_dev *mdev = priv->mdev;
456
457         kfree(ring->lro.lro_arr);
458         mlx4_en_unmap_buffer(&ring->wqres.buf);
459         mlx4_free_hwq_res(mdev->dev, &ring->wqres, ring->buf_size);
460         vfree(ring->rx_info);
461         ring->rx_info = NULL;
462 }
463
464 void mlx4_en_deactivate_rx_ring(struct mlx4_en_priv *priv,
465                                 struct mlx4_en_rx_ring *ring)
466 {
467         struct mlx4_en_dev *mdev = priv->mdev;
468
469         mlx4_srq_free(mdev->dev, &ring->srq);
470         mlx4_en_free_rx_buf(priv, ring);
471         mlx4_en_destroy_allocator(priv, ring);
472 }
473
474
475 /* Unmap a completed descriptor and free unused pages */
476 static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
477                                     struct mlx4_en_rx_desc *rx_desc,
478                                     struct skb_frag_struct *skb_frags,
479                                     struct skb_frag_struct *skb_frags_rx,
480                                     struct mlx4_en_rx_alloc *page_alloc,
481                                     int length)
482 {
483         struct mlx4_en_dev *mdev = priv->mdev;
484         struct mlx4_en_frag_info *frag_info;
485         int nr;
486         dma_addr_t dma;
487
488         /* Collect used fragments while replacing them in the HW descirptors */
489         for (nr = 0; nr < priv->num_frags; nr++) {
490                 frag_info = &priv->frag_info[nr];
491                 if (length <= frag_info->frag_prefix_size)
492                         break;
493
494                 /* Save page reference in skb */
495                 skb_frags_rx[nr].page = skb_frags[nr].page;
496                 skb_frags_rx[nr].size = skb_frags[nr].size;
497                 skb_frags_rx[nr].page_offset = skb_frags[nr].page_offset;
498                 dma = be64_to_cpu(rx_desc->data[nr].addr);
499
500                 /* Allocate a replacement page */
501                 if (mlx4_en_alloc_frag(priv, rx_desc, skb_frags, page_alloc, nr))
502                         goto fail;
503
504                 /* Unmap buffer */
505                 pci_unmap_single(mdev->pdev, dma, skb_frags[nr].size,
506                                  PCI_DMA_FROMDEVICE);
507         }
508         /* Adjust size of last fragment to match actual length */
509         if (nr > 0)
510                 skb_frags_rx[nr - 1].size = length -
511                         priv->frag_info[nr - 1].frag_prefix_size;
512         return nr;
513
514 fail:
515         /* Drop all accumulated fragments (which have already been replaced in
516          * the descriptor) of this packet; remaining fragments are reused... */
517         while (nr > 0) {
518                 nr--;
519                 put_page(skb_frags_rx[nr].page);
520         }
521         return 0;
522 }
523
524
525 static struct sk_buff *mlx4_en_rx_skb(struct mlx4_en_priv *priv,
526                                       struct mlx4_en_rx_desc *rx_desc,
527                                       struct skb_frag_struct *skb_frags,
528                                       struct mlx4_en_rx_alloc *page_alloc,
529                                       unsigned int length)
530 {
531         struct mlx4_en_dev *mdev = priv->mdev;
532         struct sk_buff *skb;
533         void *va;
534         int used_frags;
535         dma_addr_t dma;
536
537         skb = dev_alloc_skb(SMALL_PACKET_SIZE + NET_IP_ALIGN);
538         if (!skb) {
539                 en_dbg(RX_ERR, priv, "Failed allocating skb\n");
540                 return NULL;
541         }
542         skb->dev = priv->dev;
543         skb_reserve(skb, NET_IP_ALIGN);
544         skb->len = length;
545         skb->truesize = length + sizeof(struct sk_buff);
546
547         /* Get pointer to first fragment so we could copy the headers into the
548          * (linear part of the) skb */
549         va = page_address(skb_frags[0].page) + skb_frags[0].page_offset;
550
551         if (length <= SMALL_PACKET_SIZE) {
552                 /* We are copying all relevant data to the skb - temporarily
553                  * synch buffers for the copy */
554                 dma = be64_to_cpu(rx_desc->data[0].addr);
555                 dma_sync_single_range_for_cpu(&mdev->pdev->dev, dma, 0,
556                                               length, DMA_FROM_DEVICE);
557                 skb_copy_to_linear_data(skb, va, length);
558                 dma_sync_single_range_for_device(&mdev->pdev->dev, dma, 0,
559                                                  length, DMA_FROM_DEVICE);
560                 skb->tail += length;
561         } else {
562
563                 /* Move relevant fragments to skb */
564                 used_frags = mlx4_en_complete_rx_desc(priv, rx_desc, skb_frags,
565                                                       skb_shinfo(skb)->frags,
566                                                       page_alloc, length);
567                 if (unlikely(!used_frags)) {
568                         kfree_skb(skb);
569                         return NULL;
570                 }
571                 skb_shinfo(skb)->nr_frags = used_frags;
572
573                 /* Copy headers into the skb linear buffer */
574                 memcpy(skb->data, va, HEADER_COPY_SIZE);
575                 skb->tail += HEADER_COPY_SIZE;
576
577                 /* Skip headers in first fragment */
578                 skb_shinfo(skb)->frags[0].page_offset += HEADER_COPY_SIZE;
579
580                 /* Adjust size of first fragment */
581                 skb_shinfo(skb)->frags[0].size -= HEADER_COPY_SIZE;
582                 skb->data_len = length - HEADER_COPY_SIZE;
583         }
584         return skb;
585 }
586
587
588 int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int budget)
589 {
590         struct mlx4_en_priv *priv = netdev_priv(dev);
591         struct mlx4_cqe *cqe;
592         struct mlx4_en_rx_ring *ring = &priv->rx_ring[cq->ring];
593         struct skb_frag_struct *skb_frags;
594         struct skb_frag_struct lro_frags[MLX4_EN_MAX_RX_FRAGS];
595         struct mlx4_en_rx_desc *rx_desc;
596         struct sk_buff *skb;
597         int index;
598         int nr;
599         unsigned int length;
600         int polled = 0;
601         int ip_summed;
602
603         if (!priv->port_up)
604                 return 0;
605
606         /* We assume a 1:1 mapping between CQEs and Rx descriptors, so Rx
607          * descriptor offset can be deduced from the CQE index instead of
608          * reading 'cqe->index' */
609         index = cq->mcq.cons_index & ring->size_mask;
610         cqe = &cq->buf[index];
611
612         /* Process all completed CQEs */
613         while (XNOR(cqe->owner_sr_opcode & MLX4_CQE_OWNER_MASK,
614                     cq->mcq.cons_index & cq->size)) {
615
616                 skb_frags = ring->rx_info + (index << priv->log_rx_info);
617                 rx_desc = ring->buf + (index << ring->log_stride);
618
619                 /*
620                  * make sure we read the CQE after we read the ownership bit
621                  */
622                 rmb();
623
624                 /* Drop packet on bad receive or bad checksum */
625                 if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) ==
626                                                 MLX4_CQE_OPCODE_ERROR)) {
627                         en_err(priv, "CQE completed in error - vendor "
628                                   "syndrom:%d syndrom:%d\n",
629                                   ((struct mlx4_err_cqe *) cqe)->vendor_err_syndrome,
630                                   ((struct mlx4_err_cqe *) cqe)->syndrome);
631                         goto next;
632                 }
633                 if (unlikely(cqe->badfcs_enc & MLX4_CQE_BAD_FCS)) {
634                         en_dbg(RX_ERR, priv, "Accepted frame with bad FCS\n");
635                         goto next;
636                 }
637
638                 /*
639                  * Packet is OK - process it.
640                  */
641                 length = be32_to_cpu(cqe->byte_cnt);
642                 ring->bytes += length;
643                 ring->packets++;
644
645                 if (likely(priv->rx_csum)) {
646                         if ((cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPOK)) &&
647                             (cqe->checksum == cpu_to_be16(0xffff))) {
648                                 priv->port_stats.rx_chksum_good++;
649                                 /* This packet is eligible for LRO if it is:
650                                  * - DIX Ethernet (type interpretation)
651                                  * - TCP/IP (v4)
652                                  * - without IP options
653                                  * - not an IP fragment */
654                                 if (mlx4_en_can_lro(cqe->status) &&
655                                     dev->features & NETIF_F_LRO) {
656
657                                         nr = mlx4_en_complete_rx_desc(
658                                                 priv, rx_desc,
659                                                 skb_frags, lro_frags,
660                                                 ring->page_alloc, length);
661                                         if (!nr)
662                                                 goto next;
663
664                                         if (priv->vlgrp && (cqe->vlan_my_qpn &
665                                                             cpu_to_be32(MLX4_CQE_VLAN_PRESENT_MASK))) {
666                                                 lro_vlan_hwaccel_receive_frags(
667                                                        &ring->lro, lro_frags,
668                                                        length, length,
669                                                        priv->vlgrp,
670                                                        be16_to_cpu(cqe->sl_vid),
671                                                        NULL, 0);
672                                         } else
673                                                 lro_receive_frags(&ring->lro,
674                                                                   lro_frags,
675                                                                   length,
676                                                                   length,
677                                                                   NULL, 0);
678
679                                         goto next;
680                                 }
681
682                                 /* LRO not possible, complete processing here */
683                                 ip_summed = CHECKSUM_UNNECESSARY;
684                                 INC_PERF_COUNTER(priv->pstats.lro_misses);
685                         } else {
686                                 ip_summed = CHECKSUM_NONE;
687                                 priv->port_stats.rx_chksum_none++;
688                         }
689                 } else {
690                         ip_summed = CHECKSUM_NONE;
691                         priv->port_stats.rx_chksum_none++;
692                 }
693
694                 skb = mlx4_en_rx_skb(priv, rx_desc, skb_frags,
695                                      ring->page_alloc, length);
696                 if (!skb) {
697                         priv->stats.rx_dropped++;
698                         goto next;
699                 }
700
701                 skb->ip_summed = ip_summed;
702                 skb->protocol = eth_type_trans(skb, dev);
703                 skb_record_rx_queue(skb, cq->ring);
704
705                 /* Push it up the stack */
706                 if (priv->vlgrp && (be32_to_cpu(cqe->vlan_my_qpn) &
707                                     MLX4_CQE_VLAN_PRESENT_MASK)) {
708                         vlan_hwaccel_receive_skb(skb, priv->vlgrp,
709                                                 be16_to_cpu(cqe->sl_vid));
710                 } else
711                         netif_receive_skb(skb);
712
713 next:
714                 ++cq->mcq.cons_index;
715                 index = (cq->mcq.cons_index) & ring->size_mask;
716                 cqe = &cq->buf[index];
717                 if (++polled == budget) {
718                         /* We are here because we reached the NAPI budget -
719                          * flush only pending LRO sessions */
720                         lro_flush_all(&ring->lro);
721                         goto out;
722                 }
723         }
724
725         /* If CQ is empty flush all LRO sessions unconditionally */
726         lro_flush_all(&ring->lro);
727
728 out:
729         AVG_PERF_COUNTER(priv->pstats.rx_coal_avg, polled);
730         mlx4_cq_set_ci(&cq->mcq);
731         wmb(); /* ensure HW sees CQ consumer before we post new buffers */
732         ring->cons = cq->mcq.cons_index;
733         ring->prod += polled; /* Polled descriptors were realocated in place */
734         mlx4_en_update_rx_prod_db(ring);
735         return polled;
736 }
737
738
739 void mlx4_en_rx_irq(struct mlx4_cq *mcq)
740 {
741         struct mlx4_en_cq *cq = container_of(mcq, struct mlx4_en_cq, mcq);
742         struct mlx4_en_priv *priv = netdev_priv(cq->dev);
743
744         if (priv->port_up)
745                 napi_schedule(&cq->napi);
746         else
747                 mlx4_en_arm_cq(priv, cq);
748 }
749
750 /* Rx CQ polling - called by NAPI */
751 int mlx4_en_poll_rx_cq(struct napi_struct *napi, int budget)
752 {
753         struct mlx4_en_cq *cq = container_of(napi, struct mlx4_en_cq, napi);
754         struct net_device *dev = cq->dev;
755         struct mlx4_en_priv *priv = netdev_priv(dev);
756         int done;
757
758         done = mlx4_en_process_rx_cq(dev, cq, budget);
759
760         /* If we used up all the quota - we're probably not done yet... */
761         if (done == budget)
762                 INC_PERF_COUNTER(priv->pstats.napi_quota);
763         else {
764                 /* Done for now */
765                 napi_complete(napi);
766                 mlx4_en_arm_cq(priv, cq);
767         }
768         return done;
769 }
770
771
772 /* Calculate the last offset position that accomodates a full fragment
773  * (assuming fagment size = stride-align) */
774 static int mlx4_en_last_alloc_offset(struct mlx4_en_priv *priv, u16 stride, u16 align)
775 {
776         u16 res = MLX4_EN_ALLOC_SIZE % stride;
777         u16 offset = MLX4_EN_ALLOC_SIZE - stride - res + align;
778
779         en_dbg(DRV, priv, "Calculated last offset for stride:%d align:%d "
780                             "res:%d offset:%d\n", stride, align, res, offset);
781         return offset;
782 }
783
784
785 static int frag_sizes[] = {
786         FRAG_SZ0,
787         FRAG_SZ1,
788         FRAG_SZ2,
789         FRAG_SZ3
790 };
791
792 void mlx4_en_calc_rx_buf(struct net_device *dev)
793 {
794         struct mlx4_en_priv *priv = netdev_priv(dev);
795         int eff_mtu = dev->mtu + ETH_HLEN + VLAN_HLEN + ETH_LLC_SNAP_SIZE;
796         int buf_size = 0;
797         int i = 0;
798
799         while (buf_size < eff_mtu) {
800                 priv->frag_info[i].frag_size =
801                         (eff_mtu > buf_size + frag_sizes[i]) ?
802                                 frag_sizes[i] : eff_mtu - buf_size;
803                 priv->frag_info[i].frag_prefix_size = buf_size;
804                 if (!i) {
805                         priv->frag_info[i].frag_align = NET_IP_ALIGN;
806                         priv->frag_info[i].frag_stride =
807                                 ALIGN(frag_sizes[i] + NET_IP_ALIGN, SMP_CACHE_BYTES);
808                 } else {
809                         priv->frag_info[i].frag_align = 0;
810                         priv->frag_info[i].frag_stride =
811                                 ALIGN(frag_sizes[i], SMP_CACHE_BYTES);
812                 }
813                 priv->frag_info[i].last_offset = mlx4_en_last_alloc_offset(
814                                                 priv, priv->frag_info[i].frag_stride,
815                                                 priv->frag_info[i].frag_align);
816                 buf_size += priv->frag_info[i].frag_size;
817                 i++;
818         }
819
820         priv->num_frags = i;
821         priv->rx_skb_size = eff_mtu;
822         priv->log_rx_info = ROUNDUP_LOG2(i * sizeof(struct skb_frag_struct));
823
824         en_dbg(DRV, priv, "Rx buffer scatter-list (effective-mtu:%d "
825                   "num_frags:%d):\n", eff_mtu, priv->num_frags);
826         for (i = 0; i < priv->num_frags; i++) {
827                 en_dbg(DRV, priv, "  frag:%d - size:%d prefix:%d align:%d "
828                                 "stride:%d last_offset:%d\n", i,
829                                 priv->frag_info[i].frag_size,
830                                 priv->frag_info[i].frag_prefix_size,
831                                 priv->frag_info[i].frag_align,
832                                 priv->frag_info[i].frag_stride,
833                                 priv->frag_info[i].last_offset);
834         }
835 }
836
837 /* RSS related functions */
838
839 /* Calculate rss size and map each entry in rss table to rx ring */
840 void mlx4_en_set_default_rss_map(struct mlx4_en_priv *priv,
841                                  struct mlx4_en_rss_map *rss_map,
842                                  int num_entries, int num_rings)
843 {
844         int i;
845
846         rss_map->size = roundup_pow_of_two(num_entries);
847         en_dbg(DRV, priv, "Setting default RSS map of %d entires\n",
848                rss_map->size);
849
850         for (i = 0; i < rss_map->size; i++) {
851                 rss_map->map[i] = i % num_rings;
852                 en_dbg(DRV, priv, "Entry %d ---> ring %d\n", i, rss_map->map[i]);
853         }
854 }
855
856 static int mlx4_en_config_rss_qp(struct mlx4_en_priv *priv,
857                                  int qpn, int srqn, int cqn,
858                                  enum mlx4_qp_state *state,
859                                  struct mlx4_qp *qp)
860 {
861         struct mlx4_en_dev *mdev = priv->mdev;
862         struct mlx4_qp_context *context;
863         int err = 0;
864
865         context = kmalloc(sizeof *context , GFP_KERNEL);
866         if (!context) {
867                 en_err(priv, "Failed to allocate qp context\n");
868                 return -ENOMEM;
869         }
870
871         err = mlx4_qp_alloc(mdev->dev, qpn, qp);
872         if (err) {
873                 en_err(priv, "Failed to allocate qp #%x\n", qpn);
874                 goto out;
875         }
876         qp->event = mlx4_en_sqp_event;
877
878         memset(context, 0, sizeof *context);
879         mlx4_en_fill_qp_context(priv, 0, 0, 0, 0, qpn, cqn, srqn, context);
880
881         err = mlx4_qp_to_ready(mdev->dev, &priv->res.mtt, context, qp, state);
882         if (err) {
883                 mlx4_qp_remove(mdev->dev, qp);
884                 mlx4_qp_free(mdev->dev, qp);
885         }
886 out:
887         kfree(context);
888         return err;
889 }
890
891 /* Allocate rx qp's and configure them according to rss map */
892 int mlx4_en_config_rss_steer(struct mlx4_en_priv *priv)
893 {
894         struct mlx4_en_dev *mdev = priv->mdev;
895         struct mlx4_en_rss_map *rss_map = &priv->rss_map;
896         struct mlx4_qp_context context;
897         struct mlx4_en_rss_context *rss_context;
898         void *ptr;
899         int rss_xor = mdev->profile.rss_xor;
900         u8 rss_mask = mdev->profile.rss_mask;
901         int i, srqn, qpn, cqn;
902         int err = 0;
903         int good_qps = 0;
904
905         en_dbg(DRV, priv, "Configuring rss steering\n");
906         err = mlx4_qp_reserve_range(mdev->dev, rss_map->size,
907                                     rss_map->size, &rss_map->base_qpn);
908         if (err) {
909                 en_err(priv, "Failed reserving %d qps\n", rss_map->size);
910                 return err;
911         }
912
913         for (i = 0; i < rss_map->size; i++) {
914                 cqn = priv->rx_ring[rss_map->map[i]].cqn;
915                 srqn = priv->rx_ring[rss_map->map[i]].srq.srqn;
916                 qpn = rss_map->base_qpn + i;
917                 err = mlx4_en_config_rss_qp(priv, qpn, srqn, cqn,
918                                             &rss_map->state[i],
919                                             &rss_map->qps[i]);
920                 if (err)
921                         goto rss_err;
922
923                 ++good_qps;
924         }
925
926         /* Configure RSS indirection qp */
927         err = mlx4_qp_reserve_range(mdev->dev, 1, 1, &priv->base_qpn);
928         if (err) {
929                 en_err(priv, "Failed to reserve range for RSS "
930                              "indirection qp\n");
931                 goto rss_err;
932         }
933         err = mlx4_qp_alloc(mdev->dev, priv->base_qpn, &rss_map->indir_qp);
934         if (err) {
935                 en_err(priv, "Failed to allocate RSS indirection QP\n");
936                 goto reserve_err;
937         }
938         rss_map->indir_qp.event = mlx4_en_sqp_event;
939         mlx4_en_fill_qp_context(priv, 0, 0, 0, 1, priv->base_qpn,
940                                 priv->rx_ring[0].cqn, 0, &context);
941
942         ptr = ((void *) &context) + 0x3c;
943         rss_context = (struct mlx4_en_rss_context *) ptr;
944         rss_context->base_qpn = cpu_to_be32(ilog2(rss_map->size) << 24 |
945                                             (rss_map->base_qpn));
946         rss_context->default_qpn = cpu_to_be32(rss_map->base_qpn);
947         rss_context->hash_fn = rss_xor & 0x3;
948         rss_context->flags = rss_mask << 2;
949
950         err = mlx4_qp_to_ready(mdev->dev, &priv->res.mtt, &context,
951                                &rss_map->indir_qp, &rss_map->indir_state);
952         if (err)
953                 goto indir_err;
954
955         return 0;
956
957 indir_err:
958         mlx4_qp_modify(mdev->dev, NULL, rss_map->indir_state,
959                        MLX4_QP_STATE_RST, NULL, 0, 0, &rss_map->indir_qp);
960         mlx4_qp_remove(mdev->dev, &rss_map->indir_qp);
961         mlx4_qp_free(mdev->dev, &rss_map->indir_qp);
962 reserve_err:
963         mlx4_qp_release_range(mdev->dev, priv->base_qpn, 1);
964 rss_err:
965         for (i = 0; i < good_qps; i++) {
966                 mlx4_qp_modify(mdev->dev, NULL, rss_map->state[i],
967                                MLX4_QP_STATE_RST, NULL, 0, 0, &rss_map->qps[i]);
968                 mlx4_qp_remove(mdev->dev, &rss_map->qps[i]);
969                 mlx4_qp_free(mdev->dev, &rss_map->qps[i]);
970         }
971         mlx4_qp_release_range(mdev->dev, rss_map->base_qpn, rss_map->size);
972         return err;
973 }
974
975 void mlx4_en_release_rss_steer(struct mlx4_en_priv *priv)
976 {
977         struct mlx4_en_dev *mdev = priv->mdev;
978         struct mlx4_en_rss_map *rss_map = &priv->rss_map;
979         int i;
980
981         mlx4_qp_modify(mdev->dev, NULL, rss_map->indir_state,
982                        MLX4_QP_STATE_RST, NULL, 0, 0, &rss_map->indir_qp);
983         mlx4_qp_remove(mdev->dev, &rss_map->indir_qp);
984         mlx4_qp_free(mdev->dev, &rss_map->indir_qp);
985         mlx4_qp_release_range(mdev->dev, priv->base_qpn, 1);
986
987         for (i = 0; i < rss_map->size; i++) {
988                 mlx4_qp_modify(mdev->dev, NULL, rss_map->state[i],
989                                MLX4_QP_STATE_RST, NULL, 0, 0, &rss_map->qps[i]);
990                 mlx4_qp_remove(mdev->dev, &rss_map->qps[i]);
991                 mlx4_qp_free(mdev->dev, &rss_map->qps[i]);
992         }
993         mlx4_qp_release_range(mdev->dev, rss_map->base_qpn, rss_map->size);
994 }
995
996
997
998
999