It appears that under certain circumstances, a race will result
in a double-free of an skb. This patch null's out the skb pointer
upon the skb free, avoiding the inadvertent deref of bogus data.
The next patch fixes the actual race.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: Jens Osterkamp <Jens.Osterkamp@de.ibm.com>
Cc: Kou Ishizaki <kou.ishizaki@toshiba.co.jp>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This patch separates the hardware descriptor state from the
driver descriptor state, per (old) suggestion from Ben Herrenschmidt.
This compiles and boots and seems to work.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: Jens Osterkamp <Jens.Osterkamp@de.ibm.com>
Cc: Kou Ishizaki <kou.ishizaki@toshiba.co.jp>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This moves the medium variable into the spidernet card structure.
It renames the GMII_ variables to BCM54XX specific ones.
Signed-off-by: NJens Osterkamp <jens@de.ibm.com>
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This patches removes logging for SPIDER_NET_GTMFLLINT interrupts.
Since the interrupts are not irregular, and they happen frequently
when using 100Mbps network switches.
Signed-off-by: NKou Ishizaki <kou.ishizaki@toshiba.co.jp>
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This patch adds or changes some HW specific settings for spider_net on
Celleb.
Signed-off-by: NKou Ishizaki <kou.ishizaki@toshiba.co.jp>
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This patch moves calling init_firmware() from spider_net_probe() to
spider_net_open() so as to use the driver by built-in.
Signed-off-by: NKou Ishizaki <kou.ishizaki@toshiba.co.jp>
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Add auto negotiation support for Celleb.
Signed-off-by: NKou Ishizaki <kou.ishizaki@toshiba.co.jp>
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

As of 2.6.20-git4, the spider_net driver does not compile.
This appears to be due to some archaic usage involving kobjects.

It also fixes a nasty double-free during ifdown of the interface.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: Jens Osterkamp <Jens.Osterkamp@de.ibm.com>
Cc: Kou Ishizaki <kou.ishizaki@toshiba.co.jp>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Acked-by: NJeff Garzik <jeff@garzik.org>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Make the hardware perceive the RX descriptor ring as a null-terminated linked
list, instead of a circular ring.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Add some debugging and error printing.

The show_rx_chain() prints out the status of the rx chain,
which shows that the status of the descriptors gets
messed up after the second & subsequent RX ramfulls.

Print out contents of bad packets if error occurs.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Delete possible source of chain corruption; the hardware
already knows the location of the tail, and writing it
again is likely to mess it up.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Add memory barrier to make sure that the rest of the
RX descriptor state is flushed to memory before we tell
the hardware that its ready to go.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Tell the hardware the location of the rx ring tail.
More punctuation cleanup.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Remove unused variable; this makes code easier to read.
Tweak commentary.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The invocation of the rx ring refill routine is haphazard,
it can be called from a central location.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Simplify the somewhat convoluted use of return codes
in the rx buffer handling.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Another skb leak in an error branch. Fix this by adding
call to dev_kfree_skb_irq() after moving to a more
appropriate spot.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

One of the unlikely error branches has an skb memory leak.
Fix this by handling the error conditions consistently.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

There is no need to pass a flag into spider_net_decode_one_descr()
so remove this, and perform some othre minor cleanup.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Get rid of the rxramfull tasklet, and let the NAPI poll routine
deal with this situation. (The rxramfull interrupt is simply
stating that the h/w has run out of room for incoming packets).
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This patch adds net_ratelimit to many of the printks in order to
limit extraneous warning messages (created in response to Bug 28554).
This patch supercedes all previous ratelimit patches.
This has been tested, please apply.

From: James K Lewis <jklewis@us.ibm.com>
Signed-off-by: NJames K Lewis <jklewis@us.ibm.com>
Signed-off-by: NLinas Vepstas <jlinas@austin.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The current driver code performs 512 DMA mappings of a bunch of
32-byte ring descriptor structures. This is silly, as they are
all in contiguous memory. This patch changes the code to
dma_map_coherent() each rx/tx ring as a whole.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

We forget to call spider_net_free_rx_chain_contents which does the
actual dev_kfree_skb. New skbs are allocated from skbuff_head_cache
on each "ifconfig up" letting the cache grow infinitely.

This patch fixes it.
Signed-off-by: NJens Osterkamp <jens@de.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

We use the powerpc specific low level MMIO accessor variants instead
of readl() or readl_be() because we know spidernet is not a real PCI
device and we can thus avoid the performance hit caused by the PCI
workarounds.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Correct a problem seen on later kernels running the NetPIPE application.
Specifically, NetPIPE would begin running very slowly at the 1533 packet
size.  It was determined that Spidernet slowed with an idle DMA engine.
Signed-off-by: NJames K Lewis <jklewis@us.ibm.com>
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

In an earlier patch, code was added to pad packets that were less that
ETH_ZLEN (60) bytes using the skb_pad function.  This has caused hangs when
accessing certain NFS mounted file systems.  This patch removes the check
and solves the NFS problem.  The driver, with this patch, has been tested
extensively.  Please apply.
Signed-off-by: NJames K Lewis <jklewis@us.ibm.com>
Cc: Stephen Hemminger <shemminger@osdl.org>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Fix up for make allyesconfig.
Signed-Off-By: NDavid Howells <dhowells@redhat.com>

Bugfix: rx descriptor release function fails to visit
the last entry while walking receive descriptor ring.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The ring buffer descriptors are DMA-accessed bidirectionally,
but are not declared in this way.  Fix this.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Cosmetic patch: give the variable holding the numer of descriptors
a more descriptive name, so to avoid confusion.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The current code attempts to start the TX dma every time a packet
is queued. This is too conservative, and wastes CPU time. This
patch changes behaviour to call the kick-dma function less often,
only when the tx queue is at risk of emptying.

This reduces cpu usage, improves performance.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Remove a dummy register read that is not needed.
This reduces CPU usage notably during transmit.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: James K Lewis <jklewis@us.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The transmit side of the spider ethernet driver currently
places locks around some very large chunks of code. This
results in a fair amount of lock contention is some cases.
This patch makes the locks much more fine-grained, protecting
only the cirtical sections. One lock is used to protect
three locations: the queue head and tail pointers, and the
queue low-watermark location.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: James K Lewis <jklewis@us.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This patch moves transmit queue cleanup code out of the
interrupt context, and into the NAPI polling routine.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Acked-by: NArnd Bergmann <arnd@arndb.de>
Cc: James K Lewis <jklewis@us.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Implement basic low-watermark support for the transmit queue.
Hardware low-watermarks allow a properly configured kernel
to continously stream data to a device and not have to handle
any interrupts at all in doing so. Correct zero-interrupt
operation can be actually observed for this driver, when the
socket buffer is made large enough.

The basic idea of a low-watermark interrupt is as follows.
The device driver queues up a bunch of packets for the hardware
to transmit, and then kicks the hardware to get it started.
As the hardware drains the queue of pending, untransmitted
packets, the device driver will want to know when the queue
is almost empty, so that it can queue some more packets.

If the queue drains down to the low waterark, then an interrupt
will be generated. However, if the kernel/driver continues
to add enough packets to keep the queue partially filled,
no interrupt will actually be generated, and the hardware
can continue streaming packets indefinitely in this mode.

The impelmentation is done by setting the DESCR_TXDESFLG flag
in one of the packets. When the hardware sees this flag, it will
interrupt the device driver. Because this flag is on a fixed
packet, rather than at  fixed location in the queue, the
code below needs to move the flag as more packets are
queued up. This implementation attempts to keep the flag
at about 1/4 from "empty".
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Signed-off-by: NJames K Lewis <jklewis@us.ibm.com>
Acked-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Bugfix -- the rx chain is in memory after the tx chain --
the offset being used was wrong, resulting in memory corruption
when the size of the rx and tx rings weren't exactly the same.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Turn off mis-interpretation of the queue-empty interrupt
status bit as an error.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Signed-off-by: NJames K Lewis <jklewis@us.ibm.com>
Acked-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The print message associated with the descriptor chain end interrupt
prints a bogs value. Fix that.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This patch adds a call to netif_stop_queue() when there is
no more room for more packets on the transmit queue.
Signed-off-by: NLinas Vepstas <linas@austin.ibm.com>
Cc: James K Lewis <jklewis@us.ibm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>