Skip to content

Commit b1df2a0

Browse files
torvaldstorvalds
committed
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
Pull rdma fixes from Jason Gunthorpe: "A number of driver bug fixes and a few recent regressions: - Several bug fixes for bnxt_re. Crashing, incorrect data reported, and corruption on new HW - Memory leak and crash in rxe - Fix sysfs corruption in rxe if the netdev name is too long - Fix a crash on error unwind in the new cq_pool code - Fix kobject panics in rtrs by working device lifetime properly - Fix a data corruption bug in iser target related to misaligned buffers" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: IB/isert: Fix unaligned immediate-data handling RDMA/rtrs-srv: Set .release function for rtrs srv device during device init RDMA/bnxt_re: Remove set but not used variable 'qplib_ctx' RDMA/core: Fix reported speed and width RDMA/core: Fix unsafe linked list traversal after failing to allocate CQ RDMA/bnxt_re: Remove the qp from list only if the qp destroy succeeds RDMA/bnxt_re: Fix driver crash on unaligned PSN entry address RDMA/bnxt_re: Restrict the max_gids to 256 RDMA/bnxt_re: Static NQ depth allocation RDMA/bnxt_re: Fix the qp table indexing RDMA/bnxt_re: Do not report transparent vlan from QP1 RDMA/mlx4: Read pkey table length instead of hardcoded value RDMA/rxe: Fix panic when calling kmem_cache_create() RDMA/rxe: Fix memleak in rxe_mem_init_user RDMA/rxe: Fix the parent sysfs read when the interface has 15 chars RDMA/rtrs-srv: Replace device_register with device_initialize and device_add
2 parents 40249c6 + 0b089c1 commit b1df2a0

File tree

19 files changed

+168
-106
lines changed

19 files changed

+168
-106
lines changed

‎drivers/infiniband/core/cq.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -379,7 +379,7 @@ static int ib_alloc_cqs(struct ib_device *dev, unsigned int nr_cqes,
379379
{
380380
LIST_HEAD(tmp_list);
381381
unsigned int nr_cqs, i;
382-
struct ib_cq *cq;
382+
struct ib_cq *cq, *n;
383383
int ret;
384384

385385
if (poll_ctx > IB_POLL_LAST_POOL_TYPE) {
@@ -412,7 +412,7 @@ static int ib_alloc_cqs(struct ib_device *dev, unsigned int nr_cqes,
412412
return 0;
413413

414414
out_free_cqs:
415-
list_for_each_entry(cq, &tmp_list, pool_entry) {
415+
list_for_each_entry_safe(cq, n, &tmp_list, pool_entry) {
416416
cq->shared = false;
417417
ib_free_cq(cq);
418418
}

‎drivers/infiniband/core/verbs.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1801,7 +1801,7 @@ int ib_get_eth_speed(struct ib_device *dev, u8 port_num, u8 *speed, u8 *width)
18011801

18021802
dev_put(netdev);
18031803

1804-
if (!rc) {
1804+
if (!rc && lksettings.base.speed != (u32)SPEED_UNKNOWN) {
18051805
netdev_speed = lksettings.base.speed;
18061806
} else {
18071807
netdev_speed = SPEED_1000;

‎drivers/infiniband/hw/bnxt_re/ib_verbs.c

Lines changed: 29 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -752,12 +752,6 @@ static int bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp)
752752
gsi_sqp = rdev->gsi_ctx.gsi_sqp;
753753
gsi_sah = rdev->gsi_ctx.gsi_sah;
754754

755-
/* remove from active qp list */
756-
mutex_lock(&rdev->qp_lock);
757-
list_del(&gsi_sqp->list);
758-
mutex_unlock(&rdev->qp_lock);
759-
atomic_dec(&rdev->qp_count);
760-
761755
ibdev_dbg(&rdev->ibdev, "Destroy the shadow AH\n");
762756
bnxt_qplib_destroy_ah(&rdev->qplib_res,
763757
&gsi_sah->qplib_ah,
@@ -772,6 +766,12 @@ static int bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp)
772766
}
773767
bnxt_qplib_free_qp_res(&rdev->qplib_res, &gsi_sqp->qplib_qp);
774768

769+
/* remove from active qp list */
770+
mutex_lock(&rdev->qp_lock);
771+
list_del(&gsi_sqp->list);
772+
mutex_unlock(&rdev->qp_lock);
773+
atomic_dec(&rdev->qp_count);
774+
775775
kfree(rdev->gsi_ctx.sqp_tbl);
776776
kfree(gsi_sah);
777777
kfree(gsi_sqp);
@@ -792,11 +792,6 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp, struct ib_udata *udata)
792792
unsigned int flags;
793793
int rc;
794794

795-
mutex_lock(&rdev->qp_lock);
796-
list_del(&qp->list);
797-
mutex_unlock(&rdev->qp_lock);
798-
atomic_dec(&rdev->qp_count);
799-
800795
bnxt_qplib_flush_cqn_wq(&qp->qplib_qp);
801796

802797
rc = bnxt_qplib_destroy_qp(&rdev->qplib_res, &qp->qplib_qp);
@@ -819,6 +814,11 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp, struct ib_udata *udata)
819814
goto sh_fail;
820815
}
821816

817+
mutex_lock(&rdev->qp_lock);
818+
list_del(&qp->list);
819+
mutex_unlock(&rdev->qp_lock);
820+
atomic_dec(&rdev->qp_count);
821+
822822
ib_umem_release(qp->rumem);
823823
ib_umem_release(qp->sumem);
824824

@@ -3264,6 +3264,19 @@ static void bnxt_re_process_res_rawqp1_wc(struct ib_wc *wc,
32643264
wc->wc_flags |= IB_WC_GRH;
32653265
}
32663266

3267+
static bool bnxt_re_check_if_vlan_valid(struct bnxt_re_dev *rdev,
3268+
u16 vlan_id)
3269+
{
3270+
/*
3271+
* Check if the vlan is configured in the host. If not configured, it
3272+
* can be a transparent VLAN. So dont report the vlan id.
3273+
*/
3274+
if (!__vlan_find_dev_deep_rcu(rdev->netdev,
3275+
htons(ETH_P_8021Q), vlan_id))
3276+
return false;
3277+
return true;
3278+
}
3279+
32673280
static bool bnxt_re_is_vlan_pkt(struct bnxt_qplib_cqe *orig_cqe,
32683281
u16 *vid, u8 *sl)
32693282
{
@@ -3332,9 +3345,11 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *gsi_sqp,
33323345
wc->src_qp = orig_cqe->src_qp;
33333346
memcpy(wc->smac, orig_cqe->smac, ETH_ALEN);
33343347
if (bnxt_re_is_vlan_pkt(orig_cqe, &vlan_id, &sl)) {
3335-
wc->vlan_id = vlan_id;
3336-
wc->sl = sl;
3337-
wc->wc_flags |= IB_WC_WITH_VLAN;
3348+
if (bnxt_re_check_if_vlan_valid(rdev, vlan_id)) {
3349+
wc->vlan_id = vlan_id;
3350+
wc->sl = sl;
3351+
wc->wc_flags |= IB_WC_WITH_VLAN;
3352+
}
33383353
}
33393354
wc->port_num = 1;
33403355
wc->vendor_err = orig_cqe->status;

‎drivers/infiniband/hw/bnxt_re/main.c

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1009,7 +1009,6 @@ static void bnxt_re_free_res(struct bnxt_re_dev *rdev)
10091009
static int bnxt_re_alloc_res(struct bnxt_re_dev *rdev)
10101010
{
10111011
struct bnxt_re_ring_attr rattr = {};
1012-
struct bnxt_qplib_ctx *qplib_ctx;
10131012
int num_vec_created = 0;
10141013
int rc = 0, i;
10151014
u8 type;
@@ -1032,13 +1031,11 @@ static int bnxt_re_alloc_res(struct bnxt_re_dev *rdev)
10321031
if (rc)
10331032
goto dealloc_res;
10341033

1035-
qplib_ctx = &rdev->qplib_ctx;
10361034
for (i = 0; i < rdev->num_msix - 1; i++) {
10371035
struct bnxt_qplib_nq *nq;
10381036

10391037
nq = &rdev->nq[i];
1040-
nq->hwq.max_elements = (qplib_ctx->cq_count +
1041-
qplib_ctx->srqc_count + 2);
1038+
nq->hwq.max_elements = BNXT_QPLIB_NQE_MAX_CNT;
10421039
rc = bnxt_qplib_alloc_nq(&rdev->qplib_res, &rdev->nq[i]);
10431040
if (rc) {
10441041
ibdev_err(&rdev->ibdev, "Alloc Failed NQ%d rc:%#x",

‎drivers/infiniband/hw/bnxt_re/qplib_fp.c

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -818,6 +818,7 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
818818
u16 cmd_flags = 0;
819819
u32 qp_flags = 0;
820820
u8 pg_sz_lvl;
821+
u32 tbl_indx;
821822
int rc;
822823

823824
RCFW_CMD_PREP(req, CREATE_QP1, cmd_flags);
@@ -907,8 +908,9 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
907908
rq->dbinfo.db = qp->dpi->dbr;
908909
rq->dbinfo.max_slot = bnxt_qplib_set_rq_max_slot(rq->wqe_size);
909910
}
910-
rcfw->qp_tbl[qp->id].qp_id = qp->id;
911-
rcfw->qp_tbl[qp->id].qp_handle = (void *)qp;
911+
tbl_indx = map_qp_id_to_tbl_indx(qp->id, rcfw);
912+
rcfw->qp_tbl[tbl_indx].qp_id = qp->id;
913+
rcfw->qp_tbl[tbl_indx].qp_handle = (void *)qp;
912914

913915
return 0;
914916

@@ -935,10 +937,10 @@ static void bnxt_qplib_init_psn_ptr(struct bnxt_qplib_qp *qp, int size)
935937

936938
sq = &qp->sq;
937939
hwq = &sq->hwq;
940+
/* First psn entry */
938941
fpsne = (u64)bnxt_qplib_get_qe(hwq, hwq->depth, &psn_pg);
939942
if (!IS_ALIGNED(fpsne, PAGE_SIZE))
940-
indx_pad = ALIGN(fpsne, PAGE_SIZE) / size;
941-
943+
indx_pad = (fpsne & ~PAGE_MASK) / size;
942944
hwq->pad_pgofft = indx_pad;
943945
hwq->pad_pg = (u64 *)psn_pg;
944946
hwq->pad_stride = size;
@@ -959,6 +961,7 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
959961
u16 cmd_flags = 0;
960962
u32 qp_flags = 0;
961963
u8 pg_sz_lvl;
964+
u32 tbl_indx;
962965
u16 nsge;
963966

964967
RCFW_CMD_PREP(req, CREATE_QP, cmd_flags);
@@ -1111,8 +1114,9 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
11111114
rq->dbinfo.db = qp->dpi->dbr;
11121115
rq->dbinfo.max_slot = bnxt_qplib_set_rq_max_slot(rq->wqe_size);
11131116
}
1114-
rcfw->qp_tbl[qp->id].qp_id = qp->id;
1115-
rcfw->qp_tbl[qp->id].qp_handle = (void *)qp;
1117+
tbl_indx = map_qp_id_to_tbl_indx(qp->id, rcfw);
1118+
rcfw->qp_tbl[tbl_indx].qp_id = qp->id;
1119+
rcfw->qp_tbl[tbl_indx].qp_handle = (void *)qp;
11161120

11171121
return 0;
11181122
fail:
@@ -1457,19 +1461,21 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res,
14571461
struct cmdq_destroy_qp req;
14581462
struct creq_destroy_qp_resp resp;
14591463
u16 cmd_flags = 0;
1464+
u32 tbl_indx;
14601465
int rc;
14611466

1462-
rcfw->qp_tbl[qp->id].qp_id = BNXT_QPLIB_QP_ID_INVALID;
1463-
rcfw->qp_tbl[qp->id].qp_handle = NULL;
1467+
tbl_indx = map_qp_id_to_tbl_indx(qp->id, rcfw);
1468+
rcfw->qp_tbl[tbl_indx].qp_id = BNXT_QPLIB_QP_ID_INVALID;
1469+
rcfw->qp_tbl[tbl_indx].qp_handle = NULL;
14641470

14651471
RCFW_CMD_PREP(req, DESTROY_QP, cmd_flags);
14661472

14671473
req.qp_cid = cpu_to_le32(qp->id);
14681474
rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
14691475
(void *)&resp, NULL, 0);
14701476
if (rc) {
1471-
rcfw->qp_tbl[qp->id].qp_id = qp->id;
1472-
rcfw->qp_tbl[qp->id].qp_handle = qp;
1477+
rcfw->qp_tbl[tbl_indx].qp_id = qp->id;
1478+
rcfw->qp_tbl[tbl_indx].qp_handle = qp;
14731479
return rc;
14741480
}
14751481

‎drivers/infiniband/hw/bnxt_re/qplib_rcfw.c

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -307,14 +307,15 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
307307
__le16 mcookie;
308308
u16 cookie;
309309
int rc = 0;
310-
u32 qp_id;
310+
u32 qp_id, tbl_indx;
311311

312312
pdev = rcfw->pdev;
313313
switch (qp_event->event) {
314314
case CREQ_QP_EVENT_EVENT_QP_ERROR_NOTIFICATION:
315315
err_event = (struct creq_qp_error_notification *)qp_event;
316316
qp_id = le32_to_cpu(err_event->xid);
317-
qp = rcfw->qp_tbl[qp_id].qp_handle;
317+
tbl_indx = map_qp_id_to_tbl_indx(qp_id, rcfw);
318+
qp = rcfw->qp_tbl[tbl_indx].qp_handle;
318319
dev_dbg(&pdev->dev, "Received QP error notification\n");
319320
dev_dbg(&pdev->dev,
320321
"qpid 0x%x, req_err=0x%x, resp_err=0x%x\n",
@@ -615,8 +616,9 @@ int bnxt_qplib_alloc_rcfw_channel(struct bnxt_qplib_res *res,
615616

616617
cmdq->bmap_size = bmap_size;
617618

618-
rcfw->qp_tbl_size = qp_tbl_sz;
619-
rcfw->qp_tbl = kcalloc(qp_tbl_sz, sizeof(struct bnxt_qplib_qp_node),
619+
/* Allocate one extra to hold the QP1 entries */
620+
rcfw->qp_tbl_size = qp_tbl_sz + 1;
621+
rcfw->qp_tbl = kcalloc(rcfw->qp_tbl_size, sizeof(struct bnxt_qplib_qp_node),
620622
GFP_KERNEL);
621623
if (!rcfw->qp_tbl)
622624
goto fail;

‎drivers/infiniband/hw/bnxt_re/qplib_rcfw.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,4 +216,9 @@ int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw);
216216
int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
217217
struct bnxt_qplib_ctx *ctx, int is_virtfn);
218218
void bnxt_qplib_mark_qp_error(void *qp_handle);
219+
static inline u32 map_qp_id_to_tbl_indx(u32 qid, struct bnxt_qplib_rcfw *rcfw)
220+
{
221+
/* Last index of the qp_tbl is for QP1 ie. qp_tbl_size - 1*/
222+
return (qid == 1) ? rcfw->qp_tbl_size - 1 : qid % rcfw->qp_tbl_size - 2;
223+
}
219224
#endif /* __BNXT_QPLIB_RCFW_H__ */

‎drivers/infiniband/hw/bnxt_re/qplib_sp.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
149149
attr->max_inline_data = le32_to_cpu(sb->max_inline_data);
150150
attr->l2_db_size = (sb->l2_db_space_size + 1) *
151151
(0x01 << RCFW_DBR_BASE_PAGE_SHIFT);
152-
attr->max_sgid = le32_to_cpu(sb->max_gid);
152+
attr->max_sgid = BNXT_QPLIB_NUM_GIDS_SUPPORTED;
153153

154154
bnxt_qplib_query_version(rcfw, attr->fw_ver);
155155

‎drivers/infiniband/hw/bnxt_re/qplib_sp.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@
4747
struct bnxt_qplib_dev_attr {
4848
#define FW_VER_ARR_LEN 4
4949
u8 fw_ver[FW_VER_ARR_LEN];
50+
#define BNXT_QPLIB_NUM_GIDS_SUPPORTED 256
5051
u16 max_sgid;
5152
u16 max_mrw;
5253
u32 max_qp;

‎drivers/infiniband/hw/mlx4/main.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -784,7 +784,8 @@ static int eth_link_query_port(struct ib_device *ibdev, u8 port,
784784
props->ip_gids = true;
785785
props->gid_tbl_len = mdev->dev->caps.gid_table_len[port];
786786
props->max_msg_sz = mdev->dev->caps.max_msg_sz;
787-
props->pkey_tbl_len = 1;
787+
if (mdev->dev->caps.pkey_table_len[port])
788+
props->pkey_tbl_len = 1;
788789
props->max_mtu = IB_MTU_4096;
789790
props->max_vl_num = 2;
790791
props->state = IB_PORT_DOWN;

0 commit comments

Comments
 (0)