Skip to content

Commit 9fc1ccc

Browse files
torvaldstorvalds
committed
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
Pull rdma fixes from Jason Gunthorpe: "Mostly irdma and bnxt_re fixes: - Missing error unwind in hf1 - For bnxt - fix fenching behavior to work on new chips, fail unsupported SRQ resize back to userspace, propogate SRQ FW failure back to userspace. - Correctly fail unsupported SRQ resize back to userspace in bnxt - Adjust a memcpy in mlx5 to not overflow a struct field. - Prevent userspace from triggering mlx5 fw syndrome logging from sysfs - Use the correct access mode for MLX5_IB_METHOD_DEVX_OBJ_MODIFY to avoid a userspace failure on modify - For irdma - Don't UAF a concurrent tasklet during destroy, prevent userspace from issuing invalid QP attrs, fix a possible CQ overflow, capture a missing HW async error event - sendmsg() triggerable memory access crash in hfi1 - Fix the srpt_service_guid parameter to not crash due to missing function pointer - Don't leak objects in error unwind in qedr - Don't weirdly cast function pointers in srpt" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/srpt: fix function pointer cast warnings RDMA/qedr: Fix qedr_create_user_qp error flow RDMA/srpt: Support specifying the srpt_service_guid parameter IB/hfi1: Fix sdma.h tx->num_descs off-by-one error RDMA/irdma: Add AE for too many RNRS RDMA/irdma: Set the CQ read threshold for GEN 1 RDMA/irdma: Validate max_send_wr and max_recv_wr RDMA/irdma: Fix KASAN issue with tasklet RDMA/mlx5: Relax DEVX access upon modify commands IB/mlx5: Don't expose debugfs entries for RRoCE general parameters if not supported RDMA/mlx5: Fix fortify source warning while accessing Eth segment RDMA/bnxt_re: Add a missing check in bnxt_qplib_query_srq RDMA/bnxt_re: Return error for SRQ resize RDMA/bnxt_re: Fix unconditional fence for newer adapters RDMA/bnxt_re: Remove a redundant check inside bnxt_re_vf_res_config RDMA/bnxt_re: Avoid creating fence MR for newer adapters IB/hfi1: Fix a memleak in init_credit_return
2 parents fca7526 + eb5c746 commit 9fc1ccc

File tree

15 files changed

+84
-36
lines changed

15 files changed

+84
-36
lines changed

‎drivers/infiniband/hw/bnxt_re/ib_verbs.c

Lines changed: 28 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -401,6 +401,10 @@ static void bnxt_re_create_fence_wqe(struct bnxt_re_pd *pd)
401401
struct bnxt_re_fence_data *fence = &pd->fence;
402402
struct ib_mr *ib_mr = &fence->mr->ib_mr;
403403
struct bnxt_qplib_swqe *wqe = &fence->bind_wqe;
404+
struct bnxt_re_dev *rdev = pd->rdev;
405+
406+
if (bnxt_qplib_is_chip_gen_p5_p7(rdev->chip_ctx))
407+
return;
404408

405409
memset(wqe, 0, sizeof(*wqe));
406410
wqe->type = BNXT_QPLIB_SWQE_TYPE_BIND_MW;
@@ -455,6 +459,9 @@ static void bnxt_re_destroy_fence_mr(struct bnxt_re_pd *pd)
455459
struct device *dev = &rdev->en_dev->pdev->dev;
456460
struct bnxt_re_mr *mr = fence->mr;
457461

462+
if (bnxt_qplib_is_chip_gen_p5_p7(rdev->chip_ctx))
463+
return;
464+
458465
if (fence->mw) {
459466
bnxt_re_dealloc_mw(fence->mw);
460467
fence->mw = NULL;
@@ -486,6 +493,9 @@ static int bnxt_re_create_fence_mr(struct bnxt_re_pd *pd)
486493
struct ib_mw *mw;
487494
int rc;
488495

496+
if (bnxt_qplib_is_chip_gen_p5_p7(rdev->chip_ctx))
497+
return 0;
498+
489499
dma_addr = dma_map_single(dev, fence->va, BNXT_RE_FENCE_BYTES,
490500
DMA_BIDIRECTIONAL);
491501
rc = dma_mapping_error(dev, dma_addr);
@@ -1817,7 +1827,7 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,
18171827
switch (srq_attr_mask) {
18181828
case IB_SRQ_MAX_WR:
18191829
/* SRQ resize is not supported */
1820-
break;
1830+
return -EINVAL;
18211831
case IB_SRQ_LIMIT:
18221832
/* Change the SRQ threshold */
18231833
if (srq_attr->srq_limit > srq->qplib_srq.max_wqe)
@@ -1832,13 +1842,12 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,
18321842
/* On success, update the shadow */
18331843
srq->srq_limit = srq_attr->srq_limit;
18341844
/* No need to Build and send response back to udata */
1835-
break;
1845+
return 0;
18361846
default:
18371847
ibdev_err(&rdev->ibdev,
18381848
"Unsupported srq_attr_mask 0x%x", srq_attr_mask);
18391849
return -EINVAL;
18401850
}
1841-
return 0;
18421851
}
18431852

18441853
int bnxt_re_query_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr)
@@ -2556,11 +2565,6 @@ static int bnxt_re_build_inv_wqe(const struct ib_send_wr *wr,
25562565
wqe->type = BNXT_QPLIB_SWQE_TYPE_LOCAL_INV;
25572566
wqe->local_inv.inv_l_key = wr->ex.invalidate_rkey;
25582567

2559-
/* Need unconditional fence for local invalidate
2560-
* opcode to work as expected.
2561-
*/
2562-
wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
2563-
25642568
if (wr->send_flags & IB_SEND_SIGNALED)
25652569
wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP;
25662570
if (wr->send_flags & IB_SEND_SOLICITED)
@@ -2583,12 +2587,6 @@ static int bnxt_re_build_reg_wqe(const struct ib_reg_wr *wr,
25832587
wqe->frmr.levels = qplib_frpl->hwq.level;
25842588
wqe->type = BNXT_QPLIB_SWQE_TYPE_REG_MR;
25852589

2586-
/* Need unconditional fence for reg_mr
2587-
* opcode to function as expected.
2588-
*/
2589-
2590-
wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
2591-
25922590
if (wr->wr.send_flags & IB_SEND_SIGNALED)
25932591
wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP;
25942592

@@ -2719,6 +2717,18 @@ static int bnxt_re_post_send_shadow_qp(struct bnxt_re_dev *rdev,
27192717
return rc;
27202718
}
27212719

2720+
static void bnxt_re_legacy_set_uc_fence(struct bnxt_qplib_swqe *wqe)
2721+
{
2722+
/* Need unconditional fence for non-wire memory opcode
2723+
* to work as expected.
2724+
*/
2725+
if (wqe->type == BNXT_QPLIB_SWQE_TYPE_LOCAL_INV ||
2726+
wqe->type == BNXT_QPLIB_SWQE_TYPE_FAST_REG_MR ||
2727+
wqe->type == BNXT_QPLIB_SWQE_TYPE_REG_MR ||
2728+
wqe->type == BNXT_QPLIB_SWQE_TYPE_BIND_MW)
2729+
wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
2730+
}
2731+
27222732
int bnxt_re_post_send(struct ib_qp *ib_qp, const struct ib_send_wr *wr,
27232733
const struct ib_send_wr **bad_wr)
27242734
{
@@ -2798,8 +2808,11 @@ int bnxt_re_post_send(struct ib_qp *ib_qp, const struct ib_send_wr *wr,
27982808
rc = -EINVAL;
27992809
goto bad;
28002810
}
2801-
if (!rc)
2811+
if (!rc) {
2812+
if (!bnxt_qplib_is_chip_gen_p5_p7(qp->rdev->chip_ctx))
2813+
bnxt_re_legacy_set_uc_fence(&wqe);
28022814
rc = bnxt_qplib_post_send(&qp->qplib_qp, &wqe);
2815+
}
28032816
bad:
28042817
if (rc) {
28052818
ibdev_err(&qp->rdev->ibdev,

‎drivers/infiniband/hw/bnxt_re/main.c

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -280,9 +280,6 @@ static void bnxt_re_set_resource_limits(struct bnxt_re_dev *rdev)
280280

281281
static void bnxt_re_vf_res_config(struct bnxt_re_dev *rdev)
282282
{
283-
284-
if (test_bit(BNXT_RE_FLAG_ERR_DEVICE_DETACHED, &rdev->flags))
285-
return;
286283
rdev->num_vfs = pci_sriov_get_totalvfs(rdev->en_dev->pdev);
287284
if (!bnxt_qplib_is_chip_gen_p5_p7(rdev->chip_ctx)) {
288285
bnxt_re_set_resource_limits(rdev);

‎drivers/infiniband/hw/bnxt_re/qplib_fp.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -744,7 +744,8 @@ int bnxt_qplib_query_srq(struct bnxt_qplib_res *res,
744744
bnxt_qplib_fill_cmdqmsg(&msg, &req, &resp, &sbuf, sizeof(req),
745745
sizeof(resp), 0);
746746
rc = bnxt_qplib_rcfw_send_message(rcfw, &msg);
747-
srq->threshold = le16_to_cpu(sb->srq_limit);
747+
if (!rc)
748+
srq->threshold = le16_to_cpu(sb->srq_limit);
748749
dma_free_coherent(&rcfw->pdev->dev, sbuf.size,
749750
sbuf.sb, sbuf.dma_addr);
750751

‎drivers/infiniband/hw/hfi1/pio.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2086,14 +2086,18 @@ int init_credit_return(struct hfi1_devdata *dd)
20862086
"Unable to allocate credit return DMA range for NUMA %d\n",
20872087
i);
20882088
ret = -ENOMEM;
2089-
goto done;
2089+
goto free_cr_base;
20902090
}
20912091
}
20922092
set_dev_node(&dd->pcidev->dev, dd->node);
20932093

20942094
ret = 0;
20952095
done:
20962096
return ret;
2097+
2098+
free_cr_base:
2099+
free_credit_return(dd);
2100+
goto done;
20972101
}
20982102

20992103
void free_credit_return(struct hfi1_devdata *dd)

‎drivers/infiniband/hw/hfi1/sdma.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3158,7 +3158,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
31583158
{
31593159
int rval = 0;
31603160

3161-
if ((unlikely(tx->num_desc + 1 == tx->desc_limit))) {
3161+
if ((unlikely(tx->num_desc == tx->desc_limit))) {
31623162
rval = _extend_sdma_tx_descs(dd, tx);
31633163
if (rval) {
31643164
__sdma_txclean(dd, tx);

‎drivers/infiniband/hw/irdma/defs.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -346,6 +346,7 @@ enum irdma_cqp_op_type {
346346
#define IRDMA_AE_LLP_TOO_MANY_KEEPALIVE_RETRIES 0x050b
347347
#define IRDMA_AE_LLP_DOUBT_REACHABILITY 0x050c
348348
#define IRDMA_AE_LLP_CONNECTION_ESTABLISHED 0x050e
349+
#define IRDMA_AE_LLP_TOO_MANY_RNRS 0x050f
349350
#define IRDMA_AE_RESOURCE_EXHAUSTION 0x0520
350351
#define IRDMA_AE_RESET_SENT 0x0601
351352
#define IRDMA_AE_TERMINATE_SENT 0x0602

‎drivers/infiniband/hw/irdma/hw.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -387,6 +387,7 @@ static void irdma_process_aeq(struct irdma_pci_f *rf)
387387
case IRDMA_AE_LLP_TOO_MANY_RETRIES:
388388
case IRDMA_AE_LCE_QP_CATASTROPHIC:
389389
case IRDMA_AE_LCE_FUNCTION_CATASTROPHIC:
390+
case IRDMA_AE_LLP_TOO_MANY_RNRS:
390391
case IRDMA_AE_LCE_CQ_CATASTROPHIC:
391392
case IRDMA_AE_UDA_XMIT_DGRAM_TOO_LONG:
392393
default:
@@ -570,6 +571,13 @@ static void irdma_destroy_irq(struct irdma_pci_f *rf,
570571
dev->irq_ops->irdma_dis_irq(dev, msix_vec->idx);
571572
irq_update_affinity_hint(msix_vec->irq, NULL);
572573
free_irq(msix_vec->irq, dev_id);
574+
if (rf == dev_id) {
575+
tasklet_kill(&rf->dpc_tasklet);
576+
} else {
577+
struct irdma_ceq *iwceq = (struct irdma_ceq *)dev_id;
578+
579+
tasklet_kill(&iwceq->dpc_tasklet);
580+
}
573581
}
574582

575583
/**

‎drivers/infiniband/hw/irdma/verbs.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -839,7 +839,9 @@ static int irdma_validate_qp_attrs(struct ib_qp_init_attr *init_attr,
839839

840840
if (init_attr->cap.max_inline_data > uk_attrs->max_hw_inline ||
841841
init_attr->cap.max_send_sge > uk_attrs->max_hw_wq_frags ||
842-
init_attr->cap.max_recv_sge > uk_attrs->max_hw_wq_frags)
842+
init_attr->cap.max_recv_sge > uk_attrs->max_hw_wq_frags ||
843+
init_attr->cap.max_send_wr > uk_attrs->max_hw_wq_quanta ||
844+
init_attr->cap.max_recv_wr > uk_attrs->max_hw_rq_quanta)
843845
return -EINVAL;
844846

845847
if (rdma_protocol_roce(&iwdev->ibdev, 1)) {
@@ -2184,9 +2186,8 @@ static int irdma_create_cq(struct ib_cq *ibcq,
21842186
info.cq_base_pa = iwcq->kmem.pa;
21852187
}
21862188

2187-
if (dev->hw_attrs.uk_attrs.hw_rev >= IRDMA_GEN_2)
2188-
info.shadow_read_threshold = min(info.cq_uk_init_info.cq_size / 2,
2189-
(u32)IRDMA_MAX_CQ_READ_THRESH);
2189+
info.shadow_read_threshold = min(info.cq_uk_init_info.cq_size / 2,
2190+
(u32)IRDMA_MAX_CQ_READ_THRESH);
21902191

21912192
if (irdma_sc_cq_init(cq, &info)) {
21922193
ibdev_dbg(&iwdev->ibdev, "VERBS: init cq fail\n");

‎drivers/infiniband/hw/mlx5/cong.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -458,6 +458,12 @@ void mlx5_ib_init_cong_debugfs(struct mlx5_ib_dev *dev, u32 port_num)
458458
dbg_cc_params->root = debugfs_create_dir("cc_params", mlx5_debugfs_get_dev_root(mdev));
459459

460460
for (i = 0; i < MLX5_IB_DBG_CC_MAX; i++) {
461+
if ((i == MLX5_IB_DBG_CC_GENERAL_RTT_RESP_DSCP_VALID ||
462+
i == MLX5_IB_DBG_CC_GENERAL_RTT_RESP_DSCP))
463+
if (!MLX5_CAP_GEN(mdev, roce) ||
464+
!MLX5_CAP_ROCE(mdev, roce_cc_general))
465+
continue;
466+
461467
dbg_cc_params->params[i].offset = i;
462468
dbg_cc_params->params[i].dev = dev;
463469
dbg_cc_params->params[i].port_num = port_num;

‎drivers/infiniband/hw/mlx5/devx.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2949,7 +2949,7 @@ DECLARE_UVERBS_NAMED_METHOD(
29492949
MLX5_IB_METHOD_DEVX_OBJ_MODIFY,
29502950
UVERBS_ATTR_IDR(MLX5_IB_ATTR_DEVX_OBJ_MODIFY_HANDLE,
29512951
UVERBS_IDR_ANY_OBJECT,
2952-
UVERBS_ACCESS_WRITE,
2952+
UVERBS_ACCESS_READ,
29532953
UA_MANDATORY),
29542954
UVERBS_ATTR_PTR_IN(
29552955
MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN,

0 commit comments

Comments
 (0)