Commit 8f6b846b authored by David Christensen's avatar David Christensen Committed by David S. Miller
Browse files

ionic: fix 16bit math issue when PAGE_SIZE >= 64KB 



The ionic device supports a maximum buffer length of 16 bits (see
ionic_rxq_desc or ionic_rxq_sg_elem).  When adding new buffers to
the receive rings, the function ionic_rx_fill() uses 16bit math when
calculating the number of pages to allocate for an RX descriptor,
given the interface's MTU setting. If the system PAGE_SIZE >= 64KB,
and the buf_info->page_offset is 0, the remain_len value will never
decrement from the original MTU value and the frag_len value will
always be 0, causing additional pages to be allocated as scatter-
gather elements unnecessarily.

A similar math issue exists in ionic_rx_frags(), but no failures
have been observed here since a 64KB page should not normally
require any scatter-gather elements at any legal Ethernet MTU size.

Fixes: 4b0a7539 ("ionic: implement Rx page reuse")
Signed-off-by: default avatarDavid Christensen <drc@linux.vnet.ibm.com>
Reviewed-by: default avatarShannon Nelson <shannon.nelson@amd.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1612cc4b

drivers/net/ethernet/pensando/ionic/ionic_dev.h

+1 −0
Original line number Diff line number Diff line
@@ -187,6 +187,7 @@ typedef void (*ionic_desc_cb)(struct ionic_queue *q, 
			      struct ionic_desc_info *desc_info,

			      struct ionic_cq_info *cq_info, void *cb_arg);



#define IONIC_MAX_BUF_LEN			((u16)-1)

#define IONIC_PAGE_SIZE				PAGE_SIZE

#define IONIC_PAGE_SPLIT_SZ			(PAGE_SIZE / 2)

#define IONIC_PAGE_GFP_MASK			(GFP_ATOMIC | __GFP_NOWARN |\

drivers/net/ethernet/pensando/ionic/ionic_txrx.c

+7 −3
Original line number Diff line number Diff line
@@ -207,7 +207,8 @@ static struct sk_buff *ionic_rx_frags(struct ionic_queue *q, 
			return NULL;

		}



		frag_len = min_t(u16, len, IONIC_PAGE_SIZE - buf_info->page_offset);

		frag_len = min_t(u16, len, min_t(u32, IONIC_MAX_BUF_LEN,

						 IONIC_PAGE_SIZE - buf_info->page_offset));

		len -= frag_len;



		dma_sync_single_for_cpu(dev,
@@ -452,7 +453,8 @@ void ionic_rx_fill(struct ionic_queue *q) 


		/* fill main descriptor - buf[0] */

		desc->addr = cpu_to_le64(buf_info->dma_addr + buf_info->page_offset);

		frag_len = min_t(u16, len, IONIC_PAGE_SIZE - buf_info->page_offset);

		frag_len = min_t(u16, len, min_t(u32, IONIC_MAX_BUF_LEN,

						 IONIC_PAGE_SIZE - buf_info->page_offset));

		desc->len = cpu_to_le16(frag_len);

		remain_len -= frag_len;

		buf_info++;
@@ -471,7 +473,9 @@ void ionic_rx_fill(struct ionic_queue *q) 
			}



			sg_elem->addr = cpu_to_le64(buf_info->dma_addr + buf_info->page_offset);

			frag_len = min_t(u16, remain_len, IONIC_PAGE_SIZE - buf_info->page_offset);

			frag_len = min_t(u16, remain_len, min_t(u32, IONIC_MAX_BUF_LEN,

								IONIC_PAGE_SIZE -

								buf_info->page_offset));

			sg_elem->len = cpu_to_le16(frag_len);

			remain_len -= frag_len;

			buf_info++;