Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Doug Ledford: - Various driver bug fixes in mlx5, mlx4, bnxt_re and qedr, ranging from bugs under load to bad error case handling - There in one largish patch fixing the locking in bnxt_re to avoid a machine hard lock situation - A few core bugs on error paths - A patch to reduce stack usage in the new CQ API - One mlx5 regression introduced in this merge window - There were new syzkaller scripts written for the RDMA subsystem and we are fixing issues found by the bot - One of the commits (aa0de36a40f4 “RDMA/mlx5: Fix integer overflow while resizing CQ”) is missing part of the commit log message and one of the SOB lines. The original patch was from Leon Romanovsky, and a cut-n-paste separator in the commit message confused patchworks which then put the end of message separator in the wrong place in the downloaded patch, and I didn’t notice in time. The patch made it into the official branch, and the only way to fix it in-place was to rebase. Given the pain that a rebase causes, and the fact that the patch has relevant tags for stable and syzkaller, a revert of the munged patch and a reapplication of the original patch with the log message intact was done. * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (25 commits) RDMA/mlx5: Fix integer overflow while resizing CQ Revert "RDMA/mlx5: Fix integer overflow while resizing CQ" RDMA/ucma: Check that user doesn't overflow QP state RDMA/mlx5: Fix integer overflow while resizing CQ RDMA/ucma: Limit possible option size IB/core: Fix possible crash to access NULL netdev RDMA/bnxt_re: Avoid Hard lockup during error CQE processing RDMA/core: Reduce poll batch for direct cq polling IB/mlx5: Fix an error code in __mlx5_ib_modify_qp() IB/mlx5: When not in dual port RoCE mode, use provided port as native IB/mlx4: Include GID type when deleting GIDs from HW table under RoCE IB/mlx4: Fix corruption of RoCEv2 IPv4 GIDs RDMA/qedr: Fix iWARP write and send with immediate RDMA/qedr: Fix kernel panic when running fio over NFSoRDMA RDMA/qedr: Fix iWARP connect with port mapper RDMA/qedr: Fix ipv6 destination address resolution IB/core : Add null pointer check in addr_resolve RDMA/bnxt_re: Fix the ib_reg failure cleanup RDMA/bnxt_re: Fix incorrect DB offset calculation RDMA/bnxt_re: Unconditionly fence non wire memory operations ...

Linus Torvalds committed 8 years ago

Commit 2f64e702 parents b3337a6 28e909123 files · +192 −156Browse files

Unified · Split

23 files

drivers/infiniband/core/addr.c +5 −10
drivers/infiniband/core/cq.c +11 −10
drivers/infiniband/core/device.c +4 −2
drivers/infiniband/core/sa_query.c +3 −4
drivers/infiniband/core/ucma.c +6 −0
drivers/infiniband/hw/bnxt_re/ib_verbs.c +19 −7
drivers/infiniband/hw/bnxt_re/ib_verbs.h +3 −0
drivers/infiniband/hw/bnxt_re/main.c +11 −1
drivers/infiniband/hw/bnxt_re/qplib_fp.c +24 −85
drivers/infiniband/hw/bnxt_re/qplib_fp.h +12 −0
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +6 −3
drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +1 −0
drivers/infiniband/hw/bnxt_re/qplib_sp.c +2 −1
drivers/infiniband/hw/bnxt_re/roce_hsi.h +24 −1
drivers/infiniband/hw/mlx4/cq.c +3 −1
drivers/infiniband/hw/mlx4/main.c +7 −4
drivers/infiniband/hw/mlx5/cq.c +8 −2
drivers/infiniband/hw/mlx5/main.c +9 −12
drivers/infiniband/hw/mlx5/mr.c +1 −1
drivers/infiniband/hw/mlx5/qp.c +9 −2
drivers/infiniband/hw/qedr/qedr_iw_cm.c +11 −8
drivers/infiniband/hw/qedr/verbs.c +12 −1
drivers/net/ethernet/mellanox/mlx5/core/health.c +1 −1

drivers/infiniband/core/addr.c+5−10

 		dst_release(dst);
 	}
-	if (ndev->flags & IFF_LOOPBACK) {
+	if (ndev) {
-		ret = rdma_translate_ip(dst_in, addr);
+		if (ndev->flags & IFF_LOOPBACK)
-		/*
+			ret = rdma_translate_ip(dst_in, addr);
-		 * Put the loopback device and get the translated
+		else
-		 * device instead.
+			addr->bound_dev_if = ndev->ifindex;
-		 */
 		dev_put(ndev);
-		ndev = dev_get_by_index(addr->net, addr->bound_dev_if);
-	} else {
-		addr->bound_dev_if = ndev->ifindex;
 	}
-	dev_put(ndev);
 	return ret;
 }

drivers/infiniband/core/cq.c+11−10

 /* # of WCs to poll for with a single call to ib_poll_cq */
 #define IB_POLL_BATCH			16
+#define IB_POLL_BATCH_DIRECT		8
 /* # of WCs to iterate over before yielding */
 #define IB_POLL_BUDGET_IRQ		256
 #define IB_POLL_FLAGS \
 	(IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS)
-static int __ib_process_cq(struct ib_cq *cq, int budget, struct ib_wc *poll_wc)
+static int __ib_process_cq(struct ib_cq *cq, int budget, struct ib_wc *wcs,
+			   int batch)
 {
 	int i, n, completed = 0;
-	struct ib_wc *wcs = poll_wc ? : cq->wc;
 	/*
 	 * budget might be (-1) if the caller does not
 	 * want to bound this call, thus we need unsigned
 	 * minimum here.
 	 */
-	while ((n = ib_poll_cq(cq, min_t(u32, IB_POLL_BATCH,
+	while ((n = ib_poll_cq(cq, min_t(u32, batch,
-			budget - completed), wcs)) > 0) {
+					 budget - completed), wcs)) > 0) {
 		for (i = 0; i < n; i++) {
 			struct ib_wc *wc = &wcs[i];
 		completed += n;
-		if (n != IB_POLL_BATCH ||
+		if (n != batch || (budget != -1 && completed >= budget))
-		    (budget != -1 && completed >= budget))
 			break;
 	}
  */
 int ib_process_cq_direct(struct ib_cq *cq, int budget)
 {
-	struct ib_wc wcs[IB_POLL_BATCH];
+	struct ib_wc wcs[IB_POLL_BATCH_DIRECT];
-	return __ib_process_cq(cq, budget, wcs);
+	return __ib_process_cq(cq, budget, wcs, IB_POLL_BATCH_DIRECT);
 }
 EXPORT_SYMBOL(ib_process_cq_direct);
 	struct ib_cq *cq = container_of(iop, struct ib_cq, iop);
 	int completed;
-	completed = __ib_process_cq(cq, budget, NULL);
+	completed = __ib_process_cq(cq, budget, cq->wc, IB_POLL_BATCH);
 	if (completed < budget) {
 		irq_poll_complete(&cq->iop);
 		if (ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0)
 	struct ib_cq *cq = container_of(work, struct ib_cq, work);
 	int completed;
-	completed = __ib_process_cq(cq, IB_POLL_BUDGET_WORKQUEUE, NULL);
+	completed = __ib_process_cq(cq, IB_POLL_BUDGET_WORKQUEUE, cq->wc,
+				    IB_POLL_BATCH);
 	if (completed >= IB_POLL_BUDGET_WORKQUEUE ||
 	    ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0)
 		queue_work(ib_comp_wq, &cq->work);

drivers/infiniband/core/device.c+4−2

 	ret = device->query_device(device, &device->attrs, &uhw);
 	if (ret) {
 		pr_warn("Couldn't query the device attributes\n");
-		goto cache_cleanup;
+		goto cg_cleanup;
 	}
 	ret = ib_device_register_sysfs(device, port_callback);
 	if (ret) {
 		pr_warn("Couldn't register device %s with driver model\n",
 			device->name);
-		goto cache_cleanup;
+		goto cg_cleanup;
 	}
 	device->reg_state = IB_DEV_REGISTERED;
 	mutex_unlock(&device_mutex);
 	return 0;
+cg_cleanup:
+	ib_device_unregister_rdmacg(device);
 cache_cleanup:
 	ib_cache_cleanup_one(device);
 	ib_cache_release_one(device);

drivers/infiniband/core/sa_query.c+3−4

 		resolved_dev = dev_get_by_index(dev_addr.net,
 						dev_addr.bound_dev_if);
-		if (resolved_dev->flags & IFF_LOOPBACK) {
+		if (!resolved_dev) {
-			dev_put(resolved_dev);
+			dev_put(idev);
-			resolved_dev = idev;
+			return -ENODEV;
-			dev_hold(resolved_dev);
 		}
 		ndev = ib_get_ndev_from_path(rec);
 		rcu_read_lock();

drivers/infiniband/core/ucma.c+6−0

 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
 		return -EFAULT;
+	if (cmd.qp_state > IB_QPS_ERR)
+		return -EINVAL;
 	ctx = ucma_get_ctx(file, cmd.id);
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);
+	if (unlikely(cmd.optval > KMALLOC_MAX_SIZE))
+		return -EINVAL;
 	optval = memdup_user((void __user *) (unsigned long) cmd.optval,
 			     cmd.optlen);
 	if (IS_ERR(optval)) {

drivers/infiniband/hw/bnxt_re/ib_verbs.c+19−7

 	return 0;
 }
-static unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp)
+unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp)
 	__acquires(&qp->scq->cq_lock) __acquires(&qp->rcq->cq_lock)
 {
 	unsigned long flags;
 	return flags;
 }
-static void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp,
+void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp,
-			       unsigned long flags)
+			unsigned long flags)
 	__releases(&qp->scq->cq_lock) __releases(&qp->rcq->cq_lock)
 {
 	if (qp->rcq != qp->scq)
 	int status;
 	union ib_gid sgid;
 	struct ib_gid_attr sgid_attr;
+	unsigned int flags;
 	u8 nw_type;
 	qp->qplib_qp.modify_flags = 0;
 			dev_dbg(rdev_to_dev(rdev),
 				"Move QP = %p to flush list\n",
 				qp);
+			flags = bnxt_re_lock_cqs(qp);
 			bnxt_qplib_add_flush_qp(&qp->qplib_qp);
+			bnxt_re_unlock_cqs(qp, flags);
 		}
 		if (!qp->sumem &&
 		    qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_RESET) {
 			dev_dbg(rdev_to_dev(rdev),
 				"Move QP = %p out of flush list\n",
 				qp);
+			flags = bnxt_re_lock_cqs(qp);
 			bnxt_qplib_clean_qp(&qp->qplib_qp);
+			bnxt_re_unlock_cqs(qp, flags);
 		}
 	}
 	if (qp_attr_mask & IB_QP_EN_SQD_ASYNC_NOTIFY) {
 	wqe->type = BNXT_QPLIB_SWQE_TYPE_LOCAL_INV;
 	wqe->local_inv.inv_l_key = wr->ex.invalidate_rkey;
+	/* Need unconditional fence for local invalidate
+	 * opcode to work as expected.
+	 */
+	wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
 	if (wr->send_flags & IB_SEND_SIGNALED)
 		wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP;
-	if (wr->send_flags & IB_SEND_FENCE)
-		wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
 	if (wr->send_flags & IB_SEND_SOLICITED)
 		wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SOLICIT_EVENT;
 	wqe->frmr.levels = qplib_frpl->hwq.level + 1;
 	wqe->type = BNXT_QPLIB_SWQE_TYPE_REG_MR;
-	if (wr->wr.send_flags & IB_SEND_FENCE)
+	/* Need unconditional fence for reg_mr
-		wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
+	 * opcode to function as expected.
+	 */
+	wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
 	if (wr->wr.send_flags & IB_SEND_SIGNALED)
 		wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP;

drivers/infiniband/hw/bnxt_re/ib_verbs.h+3−0

@@ -222,4 +222,7 @@ struct ib_ucontext bnxt_re_alloc_ucontext(struct ib_device ibdev, · 221 unmodified lines
222	struct ib_udata *udata);	222	struct ib_udata *udata);
223	int bnxt_re_dealloc_ucontext(struct ib_ucontext *context);	223	int bnxt_re_dealloc_ucontext(struct ib_ucontext *context);
224	int bnxt_re_mmap(struct ib_ucontext context, struct vm_area_struct vma);	224	int bnxt_re_mmap(struct ib_ucontext context, struct vm_area_struct vma);
		225
		226	unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp);
		227	void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp, unsigned long flags);
225	#endif /* __BNXT_RE_IB_VERBS_H__ */	228	#endif /* __BNXT_RE_IB_VERBS_H__ */

drivers/infiniband/hw/bnxt_re/main.c+11−1

 					 struct bnxt_re_qp *qp)
 {
 	struct ib_event event;
+	unsigned int flags;
+	if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR) {
+		flags = bnxt_re_lock_cqs(qp);
+		bnxt_qplib_add_flush_qp(&qp->qplib_qp);
+		bnxt_re_unlock_cqs(qp, flags);
+	}
 	memset(&event, 0, sizeof(event));
 	if (qp->qplib_qp.srq) {
 	switch (re_work->event) {
 	case NETDEV_REGISTER:
 		rc = bnxt_re_ib_reg(rdev);
-		if (rc)
+		if (rc) {
 			dev_err(rdev_to_dev(rdev),
 				"Failed to register with IB: %#x", rc);
+			bnxt_re_remove_one(rdev);
+			bnxt_re_dev_unreg(rdev);
+		}
 		break;
 	case NETDEV_UP:
 		bnxt_re_dispatch_event(&rdev->ibdev, NULL, 1,

drivers/infiniband/hw/bnxt_re/qplib_fp.c+24−85

 	}
 }
-void bnxt_qplib_acquire_cq_locks(struct bnxt_qplib_qp *qp,
+static void bnxt_qplib_acquire_cq_flush_locks(struct bnxt_qplib_qp *qp,
-				 unsigned long *flags)
+				       unsigned long *flags)
-	__acquires(&qp->scq->hwq.lock) __acquires(&qp->rcq->hwq.lock)
+	__acquires(&qp->scq->flush_lock) __acquires(&qp->rcq->flush_lock)
 {
-	spin_lock_irqsave(&qp->scq->hwq.lock, *flags);
+	spin_lock_irqsave(&qp->scq->flush_lock, *flags);
 	if (qp->scq == qp->rcq)
-		__acquire(&qp->rcq->hwq.lock);
+		__acquire(&qp->rcq->flush_lock);
 	else
-		spin_lock(&qp->rcq->hwq.lock);
+		spin_lock(&qp->rcq->flush_lock);
 }
-void bnxt_qplib_release_cq_locks(struct bnxt_qplib_qp *qp,
+static void bnxt_qplib_release_cq_flush_locks(struct bnxt_qplib_qp *qp,
-				 unsigned long *flags)
+				       unsigned long *flags)
-	__releases(&qp->scq->hwq.lock) __releases(&qp->rcq->hwq.lock)
+	__releases(&qp->scq->flush_lock) __releases(&qp->rcq->flush_lock)
 {
 	if (qp->scq == qp->rcq)
-		__release(&qp->rcq->hwq.lock);
+		__release(&qp->rcq->flush_lock);
 	else
-		spin_unlock(&qp->rcq->hwq.lock);
+		spin_unlock(&qp->rcq->flush_lock);
-	spin_unlock_irqrestore(&qp->scq->hwq.lock, *flags);
+	spin_unlock_irqrestore(&qp->scq->flush_lock, *flags);
-}
-static struct bnxt_qplib_cq *bnxt_qplib_find_buddy_cq(struct bnxt_qplib_qp *qp,
-						      struct bnxt_qplib_cq *cq)
-{
-	struct bnxt_qplib_cq *buddy_cq = NULL;
-	if (qp->scq == qp->rcq)
-		buddy_cq = NULL;
-	else if (qp->scq == cq)
-		buddy_cq = qp->rcq;
-	else
-		buddy_cq = qp->scq;
-	return buddy_cq;
-}
-static void bnxt_qplib_lock_buddy_cq(struct bnxt_qplib_qp *qp,
-				     struct bnxt_qplib_cq *cq)
-	__acquires(&buddy_cq->hwq.lock)
-{
-	struct bnxt_qplib_cq *buddy_cq = NULL;
-	buddy_cq = bnxt_qplib_find_buddy_cq(qp, cq);
-	if (!buddy_cq)
-		__acquire(&cq->hwq.lock);
-	else
-		spin_lock(&buddy_cq->hwq.lock);
-}
-static void bnxt_qplib_unlock_buddy_cq(struct bnxt_qplib_qp *qp,
-				       struct bnxt_qplib_cq *cq)
-	__releases(&buddy_cq->hwq.lock)
-{
-	struct bnxt_qplib_cq *buddy_cq = NULL;
-	buddy_cq = bnxt_qplib_find_buddy_cq(qp, cq);
-	if (!buddy_cq)
-		__release(&cq->hwq.lock);
-	else
-		spin_unlock(&buddy_cq->hwq.lock);
 }
 void bnxt_qplib_add_flush_qp(struct bnxt_qplib_qp *qp)
 {
 	unsigned long flags;
-	bnxt_qplib_acquire_cq_locks(qp, &flags);
+	bnxt_qplib_acquire_cq_flush_locks(qp, &flags);
 	__bnxt_qplib_add_flush_qp(qp);
-	bnxt_qplib_release_cq_locks(qp, &flags);
+	bnxt_qplib_release_cq_flush_locks(qp, &flags);
 }
 static void __bnxt_qplib_del_flush_qp(struct bnxt_qplib_qp *qp)
 {
 	unsigned long flags;
-	bnxt_qplib_acquire_cq_locks(qp, &flags);
+	bnxt_qplib_acquire_cq_flush_locks(qp, &flags);
 	__clean_cq(qp->scq, (u64)(unsigned long)qp);
 	qp->sq.hwq.prod = 0;
 	qp->sq.hwq.cons = 0;
 	qp->rq.hwq.cons = 0;
 	__bnxt_qplib_del_flush_qp(qp);
-	bnxt_qplib_release_cq_locks(qp, &flags);
+	bnxt_qplib_release_cq_flush_locks(qp, &flags);
 }
 static void bnxt_qpn_cqn_sched_task(struct work_struct *work)
 	/* Must block new posting of SQ and RQ */
 	qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
 	bnxt_qplib_cancel_phantom_processing(qp);
-	/* Add qp to flush list of the CQ */
-	__bnxt_qplib_add_flush_qp(qp);
 }
 /* Note: SQE is valid from sw_sq_cons up to cqe_sq_cons (exclusive)
 				sw_sq_cons, cqe->wr_id, cqe->status);
 			cqe++;
 			(*budget)--;
-			bnxt_qplib_lock_buddy_cq(qp, cq);
 			bnxt_qplib_mark_qp_error(qp);
-			bnxt_qplib_unlock_buddy_cq(qp, cq);
+			/* Add qp to flush list of the CQ */
+			bnxt_qplib_add_flush_qp(qp);
 		} else {
 			if (swq->flags & SQ_SEND_FLAGS_SIGNAL_COMP) {
 				/* Before we complete, do WA 9060 */
 		if (hwcqe->status != CQ_RES_RC_STATUS_OK) {
 			qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
 			/* Add qp to flush list of the CQ */
-			bnxt_qplib_lock_buddy_cq(qp, cq);
+			bnxt_qplib_add_flush_qp(qp);
-			__bnxt_qplib_add_flush_qp(qp);
-			bnxt_qplib_unlock_buddy_cq(qp, cq);
 		}
 	}
 		if (hwcqe->status != CQ_RES_RC_STATUS_OK) {
 			qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
 			/* Add qp to flush list of the CQ */
-			bnxt_qplib_lock_buddy_cq(qp, cq);
+			bnxt_qplib_add_flush_qp(qp);
-			__bnxt_qplib_add_flush_qp(qp);
-			bnxt_qplib_unlock_buddy_cq(qp, cq);
 		}
 	}
 done:
 bool bnxt_qplib_is_cq_empty(struct bnxt_qplib_cq *cq)
 {
 	struct cq_base *hw_cqe, **hw_cqe_ptr;
-	unsigned long flags;
 	u32 sw_cons, raw_cons;
 	bool rc = true;
-	spin_lock_irqsave(&cq->hwq.lock, flags);
 	raw_cons = cq->hwq.cons;
 	sw_cons = HWQ_CMP(raw_cons, &cq->hwq);
 	hw_cqe_ptr = (struct cq_base **)cq->hwq.pbl_ptr;
 	 /* Check for Valid bit. If the CQE is valid, return false */
 	rc = !CQE_CMP_VALID(hw_cqe, raw_cons, cq->hwq.max_elements);
-	spin_unlock_irqrestore(&cq->hwq.lock, flags);
 	return rc;
 }
 		if (hwcqe->status != CQ_RES_RC_STATUS_OK) {
 			qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
 			/* Add qp to flush list of the CQ */
-			bnxt_qplib_lock_buddy_cq(qp, cq);
+			bnxt_qplib_add_flush_qp(qp);
-			__bnxt_qplib_add_flush_qp(qp);
-			bnxt_qplib_unlock_buddy_cq(qp, cq);
 		}
 	}
 	 */
 	/* Add qp to flush list of the CQ */
-	bnxt_qplib_lock_buddy_cq(qp, cq);
+	bnxt_qplib_add_flush_qp(qp);
-	__bnxt_qplib_add_flush_qp(qp);
-	bnxt_qplib_unlock_buddy_cq(qp, cq);
 done:
 	return rc;
 }
 	u32 budget = num_cqes;
 	unsigned long flags;
-	spin_lock_irqsave(&cq->hwq.lock, flags);
+	spin_lock_irqsave(&cq->flush_lock, flags);
 	list_for_each_entry(qp, &cq->sqf_head, sq_flush) {
 		dev_dbg(&cq->hwq.pdev->dev,
 			"QPLIB: FP: Flushing SQ QP= %p",
 			qp);
 		__flush_rq(&qp->rq, qp, &cqe, &budget);
 	}
-	spin_unlock_irqrestore(&cq->hwq.lock, flags);
+	spin_unlock_irqrestore(&cq->flush_lock, flags);
 	return num_cqes - budget;
 }
 		       int num_cqes, struct bnxt_qplib_qp **lib_qp)
 {
 	struct cq_base *hw_cqe, **hw_cqe_ptr;
-	unsigned long flags;
 	u32 sw_cons, raw_cons;
 	int budget, rc = 0;
-	spin_lock_irqsave(&cq->hwq.lock, flags);
 	raw_cons = cq->hwq.cons;
 	budget = num_cqes;
 		bnxt_qplib_arm_cq(cq, DBR_DBR_TYPE_CQ);
 	}
 exit:
-	spin_unlock_irqrestore(&cq->hwq.lock, flags);
 	return num_cqes - budget;
 }
 void bnxt_qplib_req_notify_cq(struct bnxt_qplib_cq *cq, u32 arm_type)
 {
-	unsigned long flags;
-	spin_lock_irqsave(&cq->hwq.lock, flags);
 	if (arm_type)
 		bnxt_qplib_arm_cq(cq, arm_type);
 	/* Using cq->arm_state variable to track whether to issue cq handler */
 	atomic_set(&cq->arm_state, 1);
-	spin_unlock_irqrestore(&cq->hwq.lock, flags);
 }
 void bnxt_qplib_flush_cqn_wq(struct bnxt_qplib_qp *qp)

drivers/infiniband/hw/bnxt_re/qplib_fp.h+12−0

@@ -389,6 +389,18 @@ struct bnxt_qplib_cq { · 388 unmodified lines
389	struct list_head sqf_head, rqf_head;	389	struct list_head sqf_head, rqf_head;
390	atomic_t arm_state;	390	atomic_t arm_state;
391	spinlock_t compl_lock; /* synch CQ handlers */	391	spinlock_t compl_lock; /* synch CQ handlers */
		392	/* Locking Notes:
		393	* QP can move to error state from modify_qp, async error event or error
		394	* CQE as part of poll_cq. When QP is moved to error state, it gets added
		395	* to two flush lists, one each for SQ and RQ.
		396	* Each flush list is protected by qplib_cq->flush_lock. Both scq and rcq
		397	* flush_locks should be acquired when QP is moved to error. The control path
		398	* operations(modify_qp and async error events) are synchronized with poll_cq
		399	* using upper level CQ locks (bnxt_re_cq->cq_lock) of both SCQ and RCQ.
		400	* The qplib_cq->flush_lock is required to synchronize two instances of poll_cq
		401	* of the same QP while manipulating the flush list.
		402	*/
		403	spinlock_t flush_lock; /* QP flush management */
392	};	404	};
393		405
394	#define BNXT_QPLIB_MAX_IRRQE_ENTRY_SIZE sizeof(struct xrrq_irrq)	406	#define BNXT_QPLIB_MAX_IRRQE_ENTRY_SIZE sizeof(struct xrrq_irrq)

drivers/infiniband/hw/bnxt_re/qplib_rcfw.c+6−3

@@ -305,9 +305,8 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw, · 304 unmodified lines
305	err_event->res_err_state_reason);	305	err_event->res_err_state_reason);
306	if (!qp)	306	if (!qp)
307	break;	307	break;
308	bnxt_qplib_acquire_cq_locks(qp, &flags);
309	bnxt_qplib_mark_qp_error(qp);	308	bnxt_qplib_mark_qp_error(qp);
310	bnxt_qplib_release_cq_locks(qp, &flags);	309	rcfw->aeq_handler(rcfw, qp_event, qp);
311	break;	310	break;
312	default:	311	default:
313	/* Command Response */	312	/* Command Response */
@@ -460,7 +459,11 @@ int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw, · 146 unmodified lines
460	int rc;	459	int rc;
461		460
462	RCFW_CMD_PREP(req, INITIALIZE_FW, cmd_flags);	461	RCFW_CMD_PREP(req, INITIALIZE_FW, cmd_flags);
463		462	/* Supply (log-base-2-of-host-page-size - base-page-shift)
		463	* to bono to adjust the doorbell page sizes.
		464	*/
		465	req.log2_dbr_pg_size = cpu_to_le16(PAGE_SHIFT -
		466	RCFW_DBR_BASE_PAGE_SHIFT);
464	/*	467	/*
465	* VFs need not setup the HW context area, PF	468	* VFs need not setup the HW context area, PF
466	* shall setup this area for VF. Skipping the	469	* shall setup this area for VF. Skipping the

drivers/infiniband/hw/bnxt_re/qplib_rcfw.h+1−0

@@ -49,6 +49,7 @@ · 48 unmodified lines
49	#define RCFW_COMM_SIZE 0x104	49	#define RCFW_COMM_SIZE 0x104
50		50
51	#define RCFW_DBR_PCI_BAR_REGION 2	51	#define RCFW_DBR_PCI_BAR_REGION 2
		52	#define RCFW_DBR_BASE_PAGE_SHIFT 12
52		53
53	#define RCFW_CMD_PREP(req, CMD, cmd_flags) \	54	#define RCFW_CMD_PREP(req, CMD, cmd_flags) \
54	do { \	55	do { \

drivers/infiniband/hw/bnxt_re/qplib_sp.c+2−1

@@ -139,7 +139,8 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw, · 138 unmodified lines
139	attr->max_pkey = le32_to_cpu(sb->max_pkeys);	139	attr->max_pkey = le32_to_cpu(sb->max_pkeys);
140		140
141	attr->max_inline_data = le32_to_cpu(sb->max_inline_data);	141	attr->max_inline_data = le32_to_cpu(sb->max_inline_data);
142	attr->l2_db_size = (sb->l2_db_space_size + 1) * PAGE_SIZE;	142	attr->l2_db_size = (sb->l2_db_space_size + 1) *
		143	(0x01 << RCFW_DBR_BASE_PAGE_SHIFT);
143	attr->max_sgid = le32_to_cpu(sb->max_gid);	144	attr->max_sgid = le32_to_cpu(sb->max_gid);
144		145
145	bnxt_qplib_query_version(rcfw, attr->fw_ver);	146	bnxt_qplib_query_version(rcfw, attr->fw_ver);

drivers/infiniband/hw/bnxt_re/roce_hsi.h+24−1

@@ -1761,7 +1761,30 @@ struct cmdq_initialize_fw { · 1760 unmodified lines
1761	#define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_2M (0x3UL << 4)	1761	#define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_2M (0x3UL << 4)
1762	#define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_8M (0x4UL << 4)	1762	#define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_8M (0x4UL << 4)
1763	#define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_1G (0x5UL << 4)	1763	#define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_1G (0x5UL << 4)
1764	__le16 reserved16;	1764	/* This value is (log-base-2-of-DBR-page-size - 12).
		1765	* 0 for 4KB. HW supported values are enumerated below.
		1766	*/
		1767	__le16 log2_dbr_pg_size;
		1768	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_MASK 0xfUL
		1769	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_SFT 0
		1770	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_4K 0x0UL
		1771	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_8K 0x1UL
		1772	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_16K 0x2UL
		1773	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_32K 0x3UL
		1774	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_64K 0x4UL
		1775	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_128K 0x5UL
		1776	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_256K 0x6UL
		1777	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_512K 0x7UL
		1778	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_1M 0x8UL
		1779	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_2M 0x9UL
		1780	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_4M 0xaUL
		1781	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_8M 0xbUL
		1782	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_16M 0xcUL
		1783	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_32M 0xdUL
		1784	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_64M 0xeUL
		1785	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_128M 0xfUL
		1786	#define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_LAST \
		1787	CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_128M
1765	__le64 qpc_page_dir;	1788	__le64 qpc_page_dir;
1766	__le64 mrw_page_dir;	1789	__le64 mrw_page_dir;
1767	__le64 srq_page_dir;	1790	__le64 srq_page_dir;

drivers/infiniband/hw/mlx4/cq.c+3−1

 	wc->dlid_path_bits = 0;
 	if (is_eth) {
+		wc->slid = 0;
 		wc->vlan_id = be16_to_cpu(hdr->tun.sl_vid);
 		memcpy(&(wc->smac[0]), (char *)&hdr->tun.mac_31_0, 4);
 		memcpy(&(wc->smac[4]), (char *)&hdr->tun.slid_mac_47_32, 2);
 			}
 		}
-		wc->slid	   = be16_to_cpu(cqe->rlid);
 		g_mlpath_rqpn	   = be32_to_cpu(cqe->g_mlpath_rqpn);
 		wc->src_qp	   = g_mlpath_rqpn & 0xffffff;
 		wc->dlid_path_bits = (g_mlpath_rqpn >> 24) & 0x7f;
 		wc->wc_flags	  |= mlx4_ib_ipoib_csum_ok(cqe->status,
 					cqe->checksum) ? IB_WC_IP_CSUM_OK : 0;
 		if (is_eth) {
+			wc->slid = 0;
 			wc->sl  = be16_to_cpu(cqe->sl_vid) >> 13;
 			if (be32_to_cpu(cqe->vlan_my_qpn) &
 					MLX4_CQE_CVLAN_PRESENT_MASK) {
 			memcpy(wc->smac, cqe->smac, ETH_ALEN);
 			wc->wc_flags |= (IB_WC_WITH_VLAN | IB_WC_WITH_SMAC);
 		} else {
+			wc->slid = be16_to_cpu(cqe->rlid);
 			wc->sl  = be16_to_cpu(cqe->sl_vid) >> 12;
 			wc->vlan_id = 0xffff;
 		}

drivers/infiniband/hw/mlx4/main.c+7−4

 			gid_tbl[i].version = 2;
 			if (!ipv6_addr_v4mapped((struct in6_addr *)&gids[i].gid))
 				gid_tbl[i].type = 1;
-			else
-				memset(&gid_tbl[i].gid, 0, 12);
 		}
 	}
 		if (!gids) {
 			ret = -ENOMEM;
 		} else {
-			for (i = 0; i < MLX4_MAX_PORT_GIDS; i++)
+			for (i = 0; i < MLX4_MAX_PORT_GIDS; i++) {
-				memcpy(&gids[i].gid, &port_gid_table->gids[i].gid, sizeof(union ib_gid));
+				memcpy(&gids[i].gid,
+				       &port_gid_table->gids[i].gid,
+				       sizeof(union ib_gid));
+				gids[i].gid_type =
+				    port_gid_table->gids[i].gid_type;
+			}
 		}
 	}
 	spin_unlock_bh(&iboe->lock);

drivers/infiniband/hw/mlx5/cq.c+8−2

 		wc->ex.invalidate_rkey = be32_to_cpu(cqe->imm_inval_pkey);
 		break;
 	}
-	wc->slid	   = be16_to_cpu(cqe->slid);
 	wc->src_qp	   = be32_to_cpu(cqe->flags_rqpn) & 0xffffff;
 	wc->dlid_path_bits = cqe->ml_path;
 	g = (be32_to_cpu(cqe->flags_rqpn) >> 28) & 3;
 	}
 	if (ll != IB_LINK_LAYER_ETHERNET) {
+		wc->slid = be16_to_cpu(cqe->slid);
 		wc->sl = (be32_to_cpu(cqe->flags_rqpn) >> 24) & 0xf;
 		return;
 	}
+	wc->slid = 0;
 	vlan_present = cqe->l4_l3_hdr_type & 0x1;
 	roce_packet_type   = (be32_to_cpu(cqe->flags_rqpn) >> 24) & 0x3;
 	if (vlan_present) {
 	if (ucmd.reserved0 || ucmd.reserved1)
 		return -EINVAL;
-	umem = ib_umem_get(context, ucmd.buf_addr, entries * ucmd.cqe_size,
+	/* check multiplication overflow */
+	if (ucmd.cqe_size && SIZE_MAX / ucmd.cqe_size <= entries - 1)
+		return -EINVAL;
+	umem = ib_umem_get(context, ucmd.buf_addr,
+			   (size_t)ucmd.cqe_size * entries,
 			   IB_ACCESS_LOCAL_WRITE, 1);
 	if (IS_ERR(umem)) {
 		err = PTR_ERR(umem);

drivers/infiniband/hw/mlx5/main.c+9−12

 	struct mlx5_ib_multiport_info *mpi;
 	struct mlx5_ib_port *port;
+	if (!mlx5_core_mp_enabled(ibdev->mdev) ||
+	    ll != IB_LINK_LAYER_ETHERNET) {
+		if (native_port_num)
+			*native_port_num = ib_port_num;
+		return ibdev->mdev;
+	}
 	if (native_port_num)
 		*native_port_num = 1;
-	if (!mlx5_core_mp_enabled(ibdev->mdev) || ll != IB_LINK_LAYER_ETHERNET)
-		return ibdev->mdev;
 	port = &ibdev->port[ib_port_num - 1];
 	if (!port)
 		return NULL;
 	struct mlx5_ib_dev *ibdev;
 	struct ib_event ibev;
 	bool fatal = false;
-	u8 port = 0;
+	u8 port = (u8)work->param;
 	if (mlx5_core_is_mp_slave(work->dev)) {
 		ibdev = mlx5_ib_get_ibdev_from_mpi(work->context);
 	case MLX5_DEV_EVENT_PORT_UP:
 	case MLX5_DEV_EVENT_PORT_DOWN:
 	case MLX5_DEV_EVENT_PORT_INITIALIZED:
-		port = (u8)work->param;
 		/* In RoCE, port up/down events are handled in
 		 * mlx5_netdev_event().
 		 */
 	case MLX5_DEV_EVENT_LID_CHANGE:
 		ibev.event = IB_EVENT_LID_CHANGE;
-		port = (u8)work->param;
 		break;
 	case MLX5_DEV_EVENT_PKEY_CHANGE:
 		ibev.event = IB_EVENT_PKEY_CHANGE;
-		port = (u8)work->param;
 		schedule_work(&ibdev->devr.ports[port - 1].pkey_change_work);
 		break;
 	case MLX5_DEV_EVENT_GUID_CHANGE:
 		ibev.event = IB_EVENT_GID_CHANGE;
-		port = (u8)work->param;
 		break;
 	case MLX5_DEV_EVENT_CLIENT_REREG:
 		ibev.event = IB_EVENT_CLIENT_REREGISTER;
-		port = (u8)work->param;
 		break;
 	case MLX5_DEV_EVENT_DELAY_DROP_TIMEOUT:
 		schedule_work(&ibdev->delay_drop.delay_drop_work);
 	ibev.device	      = &ibdev->ib_dev;
 	ibev.element.port_num = port;
-	if (port < 1 || port > ibdev->num_ports) {
+	if (!rdma_is_port_valid(&ibdev->ib_dev, port)) {
 		mlx5_ib_warn(ibdev, "warning: event on port %d\n", port);
 		goto out;
 	}

drivers/infiniband/hw/mlx5/mr.c+1−1

 	mr->ibmr.iova = sg_dma_address(sg) + sg_offset;
 	mr->ibmr.length = 0;
-	mr->ndescs = sg_nents;
 	for_each_sg(sgl, sg, sg_nents, i) {
 		if (unlikely(i >= mr->max_descs))
 		sg_offset = 0;
 	}
+	mr->ndescs = i;
 	if (sg_offset_p)
 		*sg_offset_p = sg_offset;

drivers/infiniband/hw/mlx5/qp.c+9−2

 	u32 uidx = MLX5_IB_DEFAULT_UIDX;
 	struct mlx5_ib_create_qp ucmd;
 	struct mlx5_ib_qp_base *base;
+	int mlx5_st;
 	void *qpc;
 	u32 *in;
 	int err;
 	spin_lock_init(&qp->sq.lock);
 	spin_lock_init(&qp->rq.lock);
+	mlx5_st = to_mlx5_st(init_attr->qp_type);
+	if (mlx5_st < 0)
+		return -EINVAL;
 	if (init_attr->rwq_ind_tbl) {
 		if (!udata)
 			return -ENOSYS;
 	qpc = MLX5_ADDR_OF(create_qp_in, in, qpc);
-	MLX5_SET(qpc, qpc, st, to_mlx5_st(init_attr->qp_type));
+	MLX5_SET(qpc, qpc, st, mlx5_st);
 	MLX5_SET(qpc, qpc, pm_state, MLX5_QP_PM_MIGRATED);
 	if (init_attr->qp_type != MLX5_IB_QPT_REG_UMR)
 		goto out;
 	if (mlx5_cur >= MLX5_QP_NUM_STATE || mlx5_new >= MLX5_QP_NUM_STATE ||
-	    !optab[mlx5_cur][mlx5_new])
+	    !optab[mlx5_cur][mlx5_new]) {
+		err = -EINVAL;
 		goto out;
+	}
 	op = optab[mlx5_cur][mlx5_new];
 	optpar = ib_mask_to_mlx5_opt(attr_mask);

drivers/infiniband/hw/qedr/qedr_iw_cm.c+11−8

 		}
 		return -EINVAL;
 	}
-	neigh = dst_neigh_lookup(dst, &dst_in);
+	neigh = dst_neigh_lookup(dst, &fl6.daddr);
 	if (neigh) {
 		rcu_read_lock();
 		if (neigh->nud_state & NUD_VALID) {
 	qp = idr_find(&dev->qpidr, conn_param->qpn);
-	laddr = (struct sockaddr_in *)&cm_id->local_addr;
+	laddr = (struct sockaddr_in *)&cm_id->m_local_addr;
-	raddr = (struct sockaddr_in *)&cm_id->remote_addr;
+	raddr = (struct sockaddr_in *)&cm_id->m_remote_addr;
-	laddr6 = (struct sockaddr_in6 *)&cm_id->local_addr;
+	laddr6 = (struct sockaddr_in6 *)&cm_id->m_local_addr;
-	raddr6 = (struct sockaddr_in6 *)&cm_id->remote_addr;
+	raddr6 = (struct sockaddr_in6 *)&cm_id->m_remote_addr;
+	DP_DEBUG(dev, QEDR_MSG_IWARP, "MAPPED %d %d\n",
+		 ntohs(((struct sockaddr_in *)&cm_id->remote_addr)->sin_port),
+		 ntohs(raddr->sin_port));
 	DP_DEBUG(dev, QEDR_MSG_IWARP,
 		 "Connect source address: %pISpc, remote address: %pISpc\n",
 	int rc;
 	int i;
-	laddr = (struct sockaddr_in *)&cm_id->local_addr;
+	laddr = (struct sockaddr_in *)&cm_id->m_local_addr;
-	laddr6 = (struct sockaddr_in6 *)&cm_id->local_addr;
+	laddr6 = (struct sockaddr_in6 *)&cm_id->m_local_addr;
 	DP_DEBUG(dev, QEDR_MSG_IWARP,
 		 "Create Listener address: %pISpc\n", &cm_id->local_addr);

drivers/infiniband/hw/qedr/verbs.c+12−1

 	switch (wr->opcode) {
 	case IB_WR_SEND_WITH_IMM:
+		if (unlikely(rdma_protocol_iwarp(&dev->ibdev, 1))) {
+			rc = -EINVAL;
+			*bad_wr = wr;
+			break;
+		}
 		wqe->req_type = RDMA_SQ_REQ_TYPE_SEND_WITH_IMM;
 		swqe = (struct rdma_sq_send_wqe_1st *)wqe;
 		swqe->wqe_size = 2;
 		break;
 	case IB_WR_RDMA_WRITE_WITH_IMM:
+		if (unlikely(rdma_protocol_iwarp(&dev->ibdev, 1))) {
+			rc = -EINVAL;
+			*bad_wr = wr;
+			break;
+		}
 		wqe->req_type = RDMA_SQ_REQ_TYPE_RDMA_WR_WITH_IMM;
 		rwqe = (struct rdma_sq_rdma_wqe_1st *)wqe;
 {
 	struct qedr_dev *dev = get_qedr_dev(ibcq->device);
 	struct qedr_cq *cq = get_qedr_cq(ibcq);
-	union rdma_cqe *cqe = cq->latest_cqe;
+	union rdma_cqe *cqe;
 	u32 old_cons, new_cons;
 	unsigned long flags;
 	int update = 0;
 		return qedr_gsi_poll_cq(ibcq, num_entries, wc);
 	spin_lock_irqsave(&cq->cq_lock, flags);
+	cqe = cq->latest_cqe;
 	old_cons = qed_chain_get_cons_idx_u32(&cq->pbl);
 	while (num_entries && is_valid_cqe(cq, cqe)) {
 		struct qedr_qp *qp;

drivers/net/ethernet/mellanox/mlx5/core/health.c+1−1

@@ -124,7 +124,7 @@ void mlx5_enter_error_state(struct mlx5_core_dev *dev, bool force) · 123 unmodified lines
124	trigger_cmd_completions(dev);	124	trigger_cmd_completions(dev);
125	}	125	}
126		126
127	mlx5_core_event(dev, MLX5_DEV_EVENT_SYS_ERROR, 0);	127	mlx5_core_event(dev, MLX5_DEV_EVENT_SYS_ERROR, 1);
128	mlx5_core_err(dev, "end\n");	128	mlx5_core_err(dev, "end\n");
129		129
130	unlock:	130	unlock:

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code