Commit 9fc1cccc authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma 

Pull rdma fixes from Jason Gunthorpe:
 "Mostly irdma and bnxt_re fixes:

   - Missing error unwind in hf1

   - For bnxt - fix fenching behavior to work on new chips, fail
     unsupported SRQ resize back to userspace, propogate SRQ FW failure
     back to userspace.

   - Correctly fail unsupported SRQ resize back to userspace in bnxt

   - Adjust a memcpy in mlx5 to not overflow a struct field.

   - Prevent userspace from triggering mlx5 fw syndrome logging from
     sysfs

   - Use the correct access mode for MLX5_IB_METHOD_DEVX_OBJ_MODIFY to
     avoid a userspace failure on modify

   - For irdma - Don't UAF a concurrent tasklet during destroy, prevent
     userspace from issuing invalid QP attrs, fix a possible CQ
     overflow, capture a missing HW async error event

   - sendmsg() triggerable memory access crash in hfi1

   - Fix the srpt_service_guid parameter to not crash due to missing
     function pointer

   - Don't leak objects in error unwind in qedr

   - Don't weirdly cast function pointers in srpt"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/srpt: fix function pointer cast warnings
  RDMA/qedr: Fix qedr_create_user_qp error flow
  RDMA/srpt: Support specifying the srpt_service_guid parameter
  IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
  RDMA/irdma: Add AE for too many RNRS
  RDMA/irdma: Set the CQ read threshold for GEN 1
  RDMA/irdma: Validate max_send_wr and max_recv_wr
  RDMA/irdma: Fix KASAN issue with tasklet
  RDMA/mlx5: Relax DEVX access upon modify commands
  IB/mlx5: Don't expose debugfs entries for RRoCE general parameters if not supported
  RDMA/mlx5: Fix fortify source warning while accessing Eth segment
  RDMA/bnxt_re: Add a missing check in bnxt_qplib_query_srq
  RDMA/bnxt_re: Return error for SRQ resize
  RDMA/bnxt_re: Fix unconditional fence for newer adapters
  RDMA/bnxt_re: Remove a redundant check inside bnxt_re_vf_res_config
  RDMA/bnxt_re: Avoid creating fence MR for newer adapters
  IB/hfi1: Fix a memleak in init_credit_return
parents fca7526b eb5c7465

drivers/infiniband/hw/bnxt_re/ib_verbs.c

+28 −15
Original line number Diff line number Diff line
@@ -401,6 +401,10 @@ static void bnxt_re_create_fence_wqe(struct bnxt_re_pd *pd) 
	struct bnxt_re_fence_data *fence = &pd->fence;

	struct ib_mr *ib_mr = &fence->mr->ib_mr;

	struct bnxt_qplib_swqe *wqe = &fence->bind_wqe;

	struct bnxt_re_dev *rdev = pd->rdev;



	if (bnxt_qplib_is_chip_gen_p5_p7(rdev->chip_ctx))

		return;



	memset(wqe, 0, sizeof(*wqe));

	wqe->type = BNXT_QPLIB_SWQE_TYPE_BIND_MW;
@@ -455,6 +459,9 @@ static void bnxt_re_destroy_fence_mr(struct bnxt_re_pd *pd) 
	struct device *dev = &rdev->en_dev->pdev->dev;

	struct bnxt_re_mr *mr = fence->mr;



	if (bnxt_qplib_is_chip_gen_p5_p7(rdev->chip_ctx))

		return;



	if (fence->mw) {

		bnxt_re_dealloc_mw(fence->mw);

		fence->mw = NULL;
@@ -486,6 +493,9 @@ static int bnxt_re_create_fence_mr(struct bnxt_re_pd *pd) 
	struct ib_mw *mw;

	int rc;



	if (bnxt_qplib_is_chip_gen_p5_p7(rdev->chip_ctx))

		return 0;



	dma_addr = dma_map_single(dev, fence->va, BNXT_RE_FENCE_BYTES,

				  DMA_BIDIRECTIONAL);

	rc = dma_mapping_error(dev, dma_addr);
@@ -1817,7 +1827,7 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr, 
	switch (srq_attr_mask) {

	case IB_SRQ_MAX_WR:

		/* SRQ resize is not supported */

		break;

		return -EINVAL;

	case IB_SRQ_LIMIT:

		/* Change the SRQ threshold */

		if (srq_attr->srq_limit > srq->qplib_srq.max_wqe)
@@ -1832,13 +1842,12 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr, 
		/* On success, update the shadow */

		srq->srq_limit = srq_attr->srq_limit;

		/* No need to Build and send response back to udata */

		break;

		return 0;

	default:

		ibdev_err(&rdev->ibdev,

			  "Unsupported srq_attr_mask 0x%x", srq_attr_mask);

		return -EINVAL;

	}

	return 0;

}



int bnxt_re_query_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr)
@@ -2556,11 +2565,6 @@ static int bnxt_re_build_inv_wqe(const struct ib_send_wr *wr, 
	wqe->type = BNXT_QPLIB_SWQE_TYPE_LOCAL_INV;

	wqe->local_inv.inv_l_key = wr->ex.invalidate_rkey;



	/* Need unconditional fence for local invalidate

	 * opcode to work as expected.

	 */

	wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;



	if (wr->send_flags & IB_SEND_SIGNALED)

		wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP;

	if (wr->send_flags & IB_SEND_SOLICITED)
@@ -2583,12 +2587,6 @@ static int bnxt_re_build_reg_wqe(const struct ib_reg_wr *wr, 
	wqe->frmr.levels = qplib_frpl->hwq.level;

	wqe->type = BNXT_QPLIB_SWQE_TYPE_REG_MR;



	/* Need unconditional fence for reg_mr

	 * opcode to function as expected.

	 */



	wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;



	if (wr->wr.send_flags & IB_SEND_SIGNALED)

		wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP;
@@ -2719,6 +2717,18 @@ static int bnxt_re_post_send_shadow_qp(struct bnxt_re_dev *rdev, 
	return rc;

}



static void bnxt_re_legacy_set_uc_fence(struct bnxt_qplib_swqe *wqe)

{

	/* Need unconditional fence for non-wire memory opcode

	 * to work as expected.

	 */

	if (wqe->type == BNXT_QPLIB_SWQE_TYPE_LOCAL_INV ||

	    wqe->type == BNXT_QPLIB_SWQE_TYPE_FAST_REG_MR ||

	    wqe->type == BNXT_QPLIB_SWQE_TYPE_REG_MR ||

	    wqe->type == BNXT_QPLIB_SWQE_TYPE_BIND_MW)

		wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;

}



int bnxt_re_post_send(struct ib_qp *ib_qp, const struct ib_send_wr *wr,

		      const struct ib_send_wr **bad_wr)

{
@@ -2798,8 +2808,11 @@ int bnxt_re_post_send(struct ib_qp *ib_qp, const struct ib_send_wr *wr, 
			rc = -EINVAL;

			goto bad;

		}

		if (!rc)

		if (!rc) {

			if (!bnxt_qplib_is_chip_gen_p5_p7(qp->rdev->chip_ctx))

				bnxt_re_legacy_set_uc_fence(&wqe);

			rc = bnxt_qplib_post_send(&qp->qplib_qp, &wqe);

		}

bad:

		if (rc) {

			ibdev_err(&qp->rdev->ibdev,

drivers/infiniband/hw/bnxt_re/main.c

+0 −3
Original line number Diff line number Diff line
@@ -280,9 +280,6 @@ static void bnxt_re_set_resource_limits(struct bnxt_re_dev *rdev) 


static void bnxt_re_vf_res_config(struct bnxt_re_dev *rdev)

{



	if (test_bit(BNXT_RE_FLAG_ERR_DEVICE_DETACHED, &rdev->flags))

		return;

	rdev->num_vfs = pci_sriov_get_totalvfs(rdev->en_dev->pdev);

	if (!bnxt_qplib_is_chip_gen_p5_p7(rdev->chip_ctx)) {

		bnxt_re_set_resource_limits(rdev);

drivers/infiniband/hw/bnxt_re/qplib_fp.c

+2 −1
Original line number Diff line number Diff line
@@ -744,6 +744,7 @@ int bnxt_qplib_query_srq(struct bnxt_qplib_res *res, 
	bnxt_qplib_fill_cmdqmsg(&msg, &req, &resp, &sbuf, sizeof(req),

				sizeof(resp), 0);

	rc = bnxt_qplib_rcfw_send_message(rcfw, &msg);

	if (!rc)

		srq->threshold = le16_to_cpu(sb->srq_limit);

	dma_free_coherent(&rcfw->pdev->dev, sbuf.size,

			  sbuf.sb, sbuf.dma_addr);

drivers/infiniband/hw/hfi1/pio.c

+5 −1
Original line number Diff line number Diff line
@@ -2086,7 +2086,7 @@ int init_credit_return(struct hfi1_devdata *dd) 
				   "Unable to allocate credit return DMA range for NUMA %d\n",

				   i);

			ret = -ENOMEM;

			goto done;

			goto free_cr_base;

		}

	}

	set_dev_node(&dd->pcidev->dev, dd->node);
@@ -2094,6 +2094,10 @@ int init_credit_return(struct hfi1_devdata *dd) 
	ret = 0;

done:

	return ret;



free_cr_base:

	free_credit_return(dd);

	goto done;

}



void free_credit_return(struct hfi1_devdata *dd)

drivers/infiniband/hw/hfi1/sdma.c

+1 −1
Original line number Diff line number Diff line
@@ -3158,7 +3158,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) 
{

	int rval = 0;



	if ((unlikely(tx->num_desc + 1 == tx->desc_limit))) {

	if ((unlikely(tx->num_desc == tx->desc_limit))) {

		rval = _extend_sdma_tx_descs(dd, tx);

		if (rval) {

			__sdma_txclean(dd, tx);