aboutsummaryrefslogtreecommitdiff
path: root/drivers/infiniband/hw
AgeCommit message (Collapse)AuthorFilesLines
2018-07-11hns: Remove a set-but-not-used variableBart Van Assche1-2/+0
Signed-off-by: Bart Van Assche <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-11IB/hfi1: Suppress a compiler warningBart Van Assche1-1/+1
Avoid that the following compiler warning is reported when building with gcc 8: drivers/infiniband/hw/hfi1/verbs.c:1896:2: warning: 'strncpy' output may be truncated copying 64 bytes from a string of length 64 [-Wstringop-truncation] Signed-off-by: Bart Van Assche <[email protected]> Reviewed-by: Dennis Dalessandro <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-11RDMA/mlx5: Fix memory leak in mlx5_ib_create_srq() error pathKamal Heib1-6/+12
Fix memory leak in the error path of mlx5_ib_create_srq() by making sure to free the allocated srq. Fixes: c2b37f76485f ("IB/mlx5: Fix integer overflows in mlx5_ib_create_srq") Signed-off-by: Kamal Heib <[email protected]> Acked-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-11RDMA/hns: Update the implementation of set_macoulijun3-16/+28
This patch updates the implementation of set_mac by using command queue instead of directly writing registers. Signed-off-by: Lijun Ou <[email protected]> Signed-off-by: Yixian Liu <[email protected]> Signed-off-by: Wei Hu (Xavier) <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-11RDMA/hns: Update the implementation of set_gidoulijun3-33/+53
This patch updates the implementation of set_gid by using command queue instead of directly writing registers. Signed-off-by: Lijun Ou <[email protected]> Signed-off-by: Yixian Liu <[email protected]> Signed-off-by: Wei Hu (Xavier) <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-11RDMA/hns: Add TPQ link table supportoulijun3-1/+31
In hip08, the TPQ(Timer Poll Queue) should be extended to host memory. This patch adds the support of TPQ. Signed-off-by: Yixian Liu <[email protected]> Signed-off-by: Lijun Ou <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-11RDMA/hns: Add TSQ link table supportoulijun3-7/+297
In hip08, TSQ(Transport Service Queue) should be extended to host memory to store the doorbells. This patch adds the support of creating TSQ, and then configured to the hardware. Signed-off-by: Yixian Liu <[email protected]> Signed-off-by: Lijun Ou <[email protected]> Signed-off-by: Wei Hu (Xavier) <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-11RDMA/hns: Fix endian conversions and annotationsoulijun3-171/+245
This patch removes the warnings reported by sparse. Signed-off-by: Lijun Ou <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-11RDMA/ocrdma: Make ocrdma_destroy_qp() easier to analyzeBart Van Assche1-5/+5
This patch does not change any functionality but avoids that sparse reports the following: drivers/infiniband/hw/ocrdma/ocrdma_verbs.c:1818:31: warning: context imbalance in 'ocrdma_destroy_qp' - different lock contexts for basic block Compile-tested only. Signed-off-by: Bart Van Assche <[email protected]> Cc: Selvin Xavier <[email protected]> Cc: Devesh Sharma <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-11infiniband: i40iw, nes: don't use wall time for TCP sequence numbersArnd Bergmann3-8/+27
The nes infiniband driver uses current_kernel_time() to get a nanosecond granunarity timestamp to initialize its tcp sequence counters. This is one of only a few remaining users of that deprecated function, so we should try to get rid of it. Aside from using a deprecated API, there are several problems I see here: - Using a CLOCK_REALTIME based time source makes it predictable in case the time base is synchronized. - Using a coarse timestamp means it only gets updated once per jiffie, making it even more predictable in order to avoid having to access the hardware clock source - The upper 2 bits are always zero because the nanoseconds are at most 999999999. For the Linux TCP implementation, we use secure_tcp_seq(), which appears to be appropriate here as well, and solves all the above problems. i40iw uses a variant of the same code, so I do that same thing there for ipv4. Unlike nes, i40e also supports ipv6, which needs to call secure_tcpv6_seq instead. Acked-by: Shiraz Saleem <[email protected]> Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-10RDMA/nes: Avoid complaints about unused variablesBart Van Assche2-5/+3
Avoid that the compiler reports the following when building with W=1: drivers/infiniband/hw/nes/nes_utils.c: In function 'nes_arp_table': drivers/infiniband/hw/nes/nes_utils.c:689:9: warning: variable 'tmp_addr' set but not used [-Wunused-but-set-variable] __be32 tmp_addr; ^~~~~~~~ drivers/infiniband/hw/nes/nes_hw.c: In function 'flush_wqes': drivers/infiniband/hw/nes/nes_hw.c:3840:6: warning: variable 'ret' set but not used [-Wunused-but-set-variable] int ret; ^~~ drivers/infiniband/hw/nes/nes_verbs.c: In function 'nes_setup_virt_qp': drivers/infiniband/hw/nes/nes_verbs.c:811:6: warning: variable 'pbl_entries' set but not used [-Wunused-but-set-variable] u32 pbl_entries; ^~~~~~~~~~~ drivers/infiniband/hw/nes/nes_verbs.c: In function 'nes_dereg_mr': drivers/infiniband/hw/nes/nes_verbs.c:2487:6: warning: variable 'minor_code' set but not used [-Wunused-but-set-variable] u16 minor_code; ^~~~~~~~~~ drivers/infiniband/hw/nes/nes_cm.c: In function 'mini_cm_recv_pkt': drivers/infiniband/hw/nes/nes_cm.c:2570:20: warning: variable 'tmp_saddr' set but not used [-Wunused-but-set-variable] __be32 tmp_daddr, tmp_saddr; ^~~~~~~~~ drivers/infiniband/hw/nes/nes_cm.c:2570:9: warning: variable 'tmp_daddr' set but not used [-Wunused-but-set-variable] __be32 tmp_daddr, tmp_saddr; ^~~~~~~~~ drivers/infiniband/hw/nes/nes_cm.c: In function 'cm_event_connected': drivers/infiniband/hw/nes/nes_cm.c:3578:22: warning: variable 'raddr' set but not used [-Wunused-but-set-variable] struct sockaddr_in *raddr; ^~~~~ drivers/infiniband/hw/nes/nes_cm.c: In function 'cm_event_reset': drivers/infiniband/hw/nes/nes_cm.c:3753:6: warning: variable 'ret' set but not used [-Wunused-but-set-variable] int ret; ^~~ Signed-off-by: Bart Van Assche <[email protected]> Cc: Faisal Latif <[email protected]> Cc: Tatyana Nikolova <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-10RDMA/cxgb4: Restore the dropped uninitialized_varJason Gunthorpe1-1/+1
In some configurations even gcc 7 cannot unravel this complexity and still throws a warning. Fixes: 4ab39e2f98f2 ("RDMA/cxgb4: Make c4iw_poll_cq_one() easier to analyze") Reported-by: Stephen Rothwell <[email protected]> Reviewed-by: Bart Van Assche <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-10IB: Enable uverbs_destroy_def_handler to be used by driversYishai Hadas1-16/+2
Enable uverbs_destroy_def_handler to be used by drivers and replace current code to use it. Signed-off-by: Yishai Hadas <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-10RDMA: Validate grh_required when handling AVsArtemy Kovalyov1-7/+16
Extend the existing grh_required flag to check when AV's are handled that a GRH is present. Since we don't want to do query_port during the AV checks for performance reasons move the flag into the immutable_data. Signed-off-by: Artemy Kovalyov <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-10RDMA/hfi1: Move grh_required into update_sm_ahJason Gunthorpe1-9/+0
grh_required is intended to be a global setting where all AV's will require a GRH, not just the sm_lid. Move the special logic to the creation of the SM AH. Signed-off-by: Jason Gunthorpe <[email protected]> Signed-off-by: Artemy Kovalyov <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]>
2018-07-10RDMA: Fix storage of PortInfo CapabilityMask in the kernelJason Gunthorpe7-15/+13
The internal flag IP_BASED_GIDS was added to a field that was being used to hold the port Info CapabilityMask without considering the effects this will have. Since most drivers just use the value from the HW MAD it means IP_BASED_GIDS will also become set on any HW that sets the IBA flag IsOtherLocalChangesNoticeSupported - which is not intended. Fix this by keeping port_cap_flags only for the IBA CapabilityMask value and store unrelated flags externally. Move the bit definitions for this to ib_mad.h to make it clear what is happening. To keep the uAPI unchanged define a new set of flags in the uapi header that are only used by ib_uverbs_query_port_resp.port_cap_flags which match the current flags supported in rdma-core, and the values exposed by the current kernel. Fixes: b4a26a27287a ("IB: Report using RoCE IP based gids in port caps") Signed-off-by: Jason Gunthorpe <[email protected]> Signed-off-by: Artemy Kovalyov <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]>
2018-07-09net: allow ndo_select_queue to pass netdevAlexander Duyck1-1/+1
This patch makes it so that instead of passing a void pointer as the accel_priv we instead pass a net_device pointer as sb_dev. Making this change allows us to pass the subordinate device through to the fallback function eventually so that we can keep the actual code in the ndo_select_queue call as focused on possible on the exception cases. Signed-off-by: Alexander Duyck <[email protected]> Tested-by: Andrew Bowers <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]>
2018-07-09IB/mlx5: Honor cnt_set_id_valid flag instead of set_idParav Pandit1-1/+1
It is incorrect to depend on set_id value to know if counters were allocated or not. set_id_valid field is set to true when counters were allocated. Therefore, use set_id_valid while deciding to free counters. Cc: <[email protected]> # 4.15 Fixes: aac4492ef23a ("IB/mlx5: Update counter implementation for dual port RoCE") Signed-off-by: Parav Pandit <[email protected]> Reviewed-by: Daniel Jurgens <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-09RDMA/mlx5: Remove unused port number parameterLeon Romanovsky1-20/+11
Clean up a little bit code to drop unused port_num parameter. Signed-off-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-09IB/mlx5: fix uaccess beyond "count" in debugfs read/write handlersJann Horn2-32/+9
In general, accessing userspace memory beyond the length of the supplied buffer in VFS read/write handlers can lead to both kernel memory corruption (via kernel_read()/kernel_write(), which can e.g. be triggered via sys_splice()) and privilege escalation inside userspace. In this case, the affected files are in debugfs (and should therefore only be accessible to root), and the read handlers check that *pos is zero (meaning that at least sys_splice() can't trigger kernel memory corruption). Because of the root requirement, this is not a security fix, but rather a cleanup. For the read handlers, fix it by using simple_read_from_buffer() instead of custom logic. Add min() calls to the write handlers. Fixes: 4a2da0b8c078 ("IB/mlx5: Add debug control parameters for congestion control") Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") Signed-off-by: Jann Horn <[email protected]> Reviewed-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-09RDMA/cxgb4: Make c4iw_poll_cq_one() easier to analyzeBart Van Assche1-27/+35
Introduce the function __c4iw_poll_cq_one() such that c4iw_poll_cq_one() becomes easier to analyze for static source code analyzers. This patch avoids that sparse reports the following: drivers/infiniband/hw/cxgb4/cq.c:401:36: warning: context imbalance in 'c4iw_flush_hw_cq' - unexpected unlock drivers/infiniband/hw/cxgb4/cq.c:824:9: warning: context imbalance in 'c4iw_poll_cq_one' - different lock contexts for basic block Compile-tested only. Signed-off-by: Bart Van Assche <[email protected]> Cc: Steve Wise <[email protected]> Acked-by: Steve Wise <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-09RDMA/cxgb3: Make iwch_poll_cq_one() easier to analyzeBart Van Assche1-28/+36
Introduce the function __iwch_poll_cq_one() to make iwch_poll_cq_one() easier to analyze for static source code analyzers. This patch avoids that sparse reports the following: drivers/infiniband/hw/cxgb3/iwch_cq.c:187:9: warning: context imbalance in 'iwch_poll_cq_one' - different lock contexts for basic block Compile-tested only. Signed-off-by: Bart Van Assche <[email protected]> Cc: Steve Wise <[email protected]> Acked-by: Steve Wise <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-09RDMA/ocrdma: Remove a set-but-not-used variableBart Van Assche1-2/+0
Signed-off-by: Bart Van Assche <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-09IB/nes: Fix a compiler warningBart Van Assche1-1/+1
Avoid that the following compiler warning is reported when building with W=1: drivers/infiniband/hw/nes/nes_hw.c:646:51: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] Signed-off-by: Bart Van Assche <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-04RDMA/uverbs: Use UVERBS_ATTR_MIN_SIZE correctly and uniformlyJason Gunthorpe1-12/+4
This newer macro allows specifying a lower bound on the accepted size, and has an 'unlimited' upper bound. Due to this it never checks for trailing zeroing so it doesn't make any sense to combine it with MIN_SZ_OR_ZERO, so drop MIN_SZ_OR_ZERO when they are used together There were a couple of places that open coded this pattern, switch them to use the clearer UVERBS_ATTR_MIN_SIZE for clarity. Signed-off-by: Jason Gunthorpe <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]>
2018-07-04RDMA/uverbs: Remove UA_FLAGSJason Gunthorpe2-37/+37
This bit of boilerplate isn't really necessary, we can use bitfields instead of a flags enum and the macros can then individually initialize them through the __VA_ARGS__ like everything else. Signed-off-by: Jason Gunthorpe <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]>
2018-07-04RDMA/uverbs: Get rid of the & in method specificationsJason Gunthorpe2-122/+150
Hide it inside the macros. The & is confusing and interferes with using this as a generic DSL in later patches. Since this also touches almost every line, also run the specs through clang-format (with 'BinPackParameters: false') to make the maintenance easier. Signed-off-by: Jason Gunthorpe <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]>
2018-07-04RDMA/uverbs: Simplify UVERBS_OBJECT and _TREE family of macrosJason Gunthorpe1-4/+4
Instead of the large set of indirecting macros, define the few needed macros to directly instantiate the struct uverbs_oject_tree_def and associated objects list. This is small amount of code duplication but the readability is far better. Signed-off-by: Jason Gunthorpe <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]>
2018-07-04RDMA/uverbs: Simplify method definition macrosJason Gunthorpe1-9/+9
Instead of the large set of indirecting macros, define the few needed macros to directly instantiate the struct uverbs_method_def and associated attributes list. This is small amount of code duplication but the readability is far better. Signed-off-by: Jason Gunthorpe <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]>
2018-07-04RDMA/uverbs: Simplify UVERBS_ATTR family of macrosJason Gunthorpe1-36/+36
Instead of using a complex cascade of macros, just directly provide the initializer list each of the declarations is trying to create. Now that the macros are simplified this also reworks the uverbs_attr_spec to be friendly to older compilers by eliminating any unnamed structures/unions inside, and removing the duplication of some fields. The structure size remains at 16 bytes which was the original motivation for some of this oddness. Signed-off-by: Jason Gunthorpe <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]>
2018-07-04RDMA/uverbs: Store the specs_root in the struct ib_uverbs_deviceJason Gunthorpe1-3/+3
The specs are required to operate the uverbs file, so they belong inside the ib_uverbs_device, not inside the ib_device. The spec passed in the ib_device is just a communication from the driver and should not be used during runtime. This also changes the lifetime of the spec memory to match the ib_uverbs_device, however at this time the spec_root can still contain driver pointers after disassociation, so it cannot be used if ib_dev is NULL. This is preparation for another series. Signed-off-by: Jason Gunthorpe <[email protected]> Reviewed-by: Michael J. Ruhl <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]>
2018-07-04Merge branch 'mlx5-dump-fill-mkey' into rdma.git for-nextJason Gunthorpe3-0/+32
For dependencies, branch based on 'mellanox/mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux.git Pull Dump and fill MKEY from Leon Romanovsky: ==================== MLX5 IB HCA offers the memory key, dump_fill_mkey to increase performance, when used in a send or receive operations. It is used to force local HCA operations to skip the PCI bus access, while keeping track of the processed length in the ibv_sge handling. In this three patch series, we expose various bits in our HW spec file (mlx5_ifc.h), move unneeded for mlx5_core FW command and export such memory key to user space thought our mlx5-abi header file. ==================== Botched auto-merge in mlx5_ib_alloc_ucontext() resolved by hand. * branch 'mlx5-dump-fill-mkey': IB/mlx5: Expose dump and fill memory key net/mlx5: Add hardware definitions for dump_fill_mkey net/mlx5: Limit scope of dump_fill_mkey function net/mlx5: Rate limit errors in command interface Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-04IB/mlx5: Expose dump and fill memory keyYonatan Cohen1-0/+16
MLX5 IB HCA offers the memory key, dump_fill_mkey to boost performance, when used in a send or receive operations. It is used to force local HCA operations to skip the PCI bus access, while keeping track of the processed length in the ibv_sge handling. Meaning, instead of a PCI write access the HCA leaves the target memory untouched, and skips filling that packet section. Similar behavior is done upon send, the HCA skips data in memory relevant to this key and saves PCI bus access. This functionality saves PCI read/write operations. Signed-off-by: Yonatan Cohen <[email protected]> Reviewed-by: Yishai Hadas <[email protected]> Reviewed-by: Guy Levi <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-04net/mlx5: Limit scope of dump_fill_mkey functionYonatan Cohen2-0/+16
mlx5_core_dump_fill_mkey() is going to be used in next patch in IB and doesn't need to be visible to whole mlx5_core. Move that command to mlx5_ib. Signed-off-by: Yonatan Cohen <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]>
2018-07-04RDMA/bnxt_re: Fix a bunch of off by one bugs in qplib_fp.cDan Carpenter1-6/+6
The srq->swq[] is allocated in bnxt_qplib_create_srq(). It has srq->hwq.max_elements elements so these tests should be > instead of >= or we might go beyond the end of the array. Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Selvin Xavier <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-04RDMA/bnxt_re: Fix a couple off by one bugsDan Carpenter1-2/+2
The sgid_tbl->tbl[] array is allocated in bnxt_qplib_alloc_sgid_tbl(). It has sgid_tbl->max elements. So the > should be >= to prevent accessing one element beyond the end of the array. Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Selvin Xavier <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-04RDMA/i40w: Hold read semaphore while looking after VMALeon Romanovsky1-0/+2
VMA lookup is supposed to be performed while mmap_sem is held. Fixes: f26c7c83395b ("i40iw: Add 2MB page support") Signed-off-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-04IB/mlx4: Test port number before querying type.Tarick Bedeir1-1/+1
rdma_ah_find_type() can reach into ib_device->port_immutable with a potentially out-of-bounds port number, so check that the port number is valid first. Fixes: 44c58487d51a ("IB/core: Define 'ib' and 'roce' rdma_ah_attr types") Signed-off-by: Tarick Bedeir <[email protected]> Reviewed-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-03vmw_pvrdma: Release netdev when vmxnet3 module is removedNeil Horman1-2/+37
On repeated module load/unload cycles, its possible for the pvrmda driver to encounter this crash: ... [ 297.032448] RIP: 0010:[<ffffffff839e4620>] [<ffffffff839e4620>] netdev_walk_all_upper_dev_rcu+0x50/0xb0 [ 297.034078] RSP: 0018:ffff95087780bd08 EFLAGS: 00010286 [ 297.034986] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff95087a0c0000 [ 297.036196] RDX: ffff95087a0c0000 RSI: ffffffff839e44e0 RDI: ffff950835d0c000 [ 297.037421] RBP: ffff95087780bd40 R08: ffff95087a0e0ea0 R09: abddacd03f8e0ea0 [ 297.038636] R10: abddacd03f8e0ea0 R11: ffffef5901e9dbc0 R12: ffff95087a0c0000 [ 297.039854] R13: ffffffff839e44e0 R14: ffff95087a0c0000 R15: ffff950835d0c828 [ 297.041071] FS: 0000000000000000(0000) GS:ffff95087fc00000(0000) knlGS:0000000000000000 [ 297.042443] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 297.043429] CR2: ffffffffffffffe8 CR3: 000000007a652000 CR4: 00000000003607f0 [ 297.044674] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 297.045893] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 297.047109] Call Trace: [ 297.047545] [<ffffffff839e4698>] netdev_has_upper_dev_all_rcu+0x18/0x20 [ 297.048691] [<ffffffffc05d31af>] is_eth_port_of_netdev+0x2f/0xa0 [ib_core] [ 297.049886] [<ffffffffc05d3180>] ? is_eth_active_slave_of_bonding_rcu+0x70/0x70 [ib_core] ... This occurs because vmw_pvrdma on probe stores a pointer to the netdev that exists on function 0 of the same bus/device/slot (which represents the vmxnet3 ethernet driver). However, it never removes this pointer if the vmxnet3 module is removed, leading to crashes resulting from use after free dereferencing incidents like the one above. The fix is pretty straightforward. vmw_pvrdma should listen for NETDEV_REGISTER and NETDEV_UNREGISTER events in its event listener code block, and update the stored netdev pointer accordingly. This solution has been tested by myself and the reporter with successful results. This fix also allows the pvrdma driver to find its underlying ethernet device in the event that vmxnet3 is loaded after pvrdma, which it was not able to do before. Signed-off-by: Neil Horman <[email protected]> Reported-by: [email protected] Tested-by: Adit Ranadive <[email protected]> Acked-by: Adit Ranadive <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-03IB/mlx5: Fix GRE flow specificationMaor Gottlieb1-1/+1
Currently the driver sets the mask of the gre_protocol to 0xffff without consideration in the user request. Fix it by copy the mask from the verbs spec. Fixes: da2f22ae7707 ("IB/mlx5: Add support for GRE flow specification") Signed-off-by: Maor Gottlieb <[email protected]> Reviewed-by: Ariel Levkovich <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-03IB/hfi1: Remove incorrect call to do_interrupt callbackMichael J. Ruhl1-7/+9
The general interrupt handler is_rcv_avail_int() has two paths, do_interrupt() (callback) and handle_user_interrupt(). The do_interrupt() callback is for the threaded receive handling. is_rcv_avail_int() cannot handle threaded IRQs. If the do_interrupt() path is taken, and the IRQ returns IRQ_WAKE_THREAD, the IRQ behavior will be indeterminate. Remove incorrect call to do_interrupt() from is_rcv_avail_int(), leaving the un-threaded (handle_user_interrupt()) path. Fixes: f4f30031c33c ("staging/rdma/hfi1: Thread the receive interrupt.") Reviewed-by: Mike Marciniszyn <[email protected]> Reviewed-by: Kamenee Arumugam <[email protected]> Signed-off-by: Michael J. Ruhl <[email protected]> Signed-off-by: Dennis Dalessandro <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-03IB/hfi1: Set in_use_ctxts bits for user ctxts onlyMichael J. Ruhl3-7/+12
The in_use_ctxts bitmask is for user receive contexts only. Setting it for any other type of receive context is incorrect. Move initial set of in_use_ctxts bits from the general context init to the user context specific init. Having this bit set can allow contexts to be incorrectly identified by some IRQ handlers. This will allow handle_user_interrupt() will now filter user contexts correctly. Clean up redundant is_rcv_urgent_int() user context check. A follow on patch will clean up an incorrect code path in the is_rcv_avail_int(). Fixes: 8737ce95c463 ("IB/hfi1: Fix an assign/ordering issue with shared context IDs") Reviewed-by: Mike Marciniszyn <[email protected]> Reviewed-by: Kamenee Arumugam <[email protected]> Signed-off-by: Michael J. Ruhl <[email protected]> Signed-off-by: Dennis Dalessandro <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-07-03IB/mlx5: Remove set-but-not-used variablesBart Van Assche2-5/+0
Avoid that the compiler complains about set-but-not-used variables when building with W=1. This patch does not change any functionality. Signed-off-by: Bart Van Assche <[email protected]> Cc: Leon Romanovsky <[email protected]> Acked-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-06-29IB: Improve uverbs_cleanup_ucontext algorithmYishai Hadas1-4/+4
Improve uverbs_cleanup_ucontext algorithm to work properly when the topology graph of the objects cannot be determined at compile time. This is the case with objects created via the devx interface in mlx5. Typically uverbs objects must be created in a strict topologically sorted order, so that LIFO ordering will generally cause them to be freed properly. There are only a few cases (eg memory windows) where objects can point to things out of the strict LIFO order. Instead of using an explicit ordering scheme where the HW destroy is not allowed to fail, go over the list multiple times and allow the destroy function to fail. If progress halts then a final, desperate, cleanup is done before leaking the memory. This indicates a driver bug. Signed-off-by: Yishai Hadas <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-06-29RDMA/mlx5: Don't leak UARs in case of free failsLeon Romanovsky1-13/+5
The failure in releasing one UAR doesn't mean that we can't continue to release rest of system pages, so don't return too early. As part of cleanup, there is no need to print warning if mlx5_cmd_free_uar() fails because such warning will be printed as part of mlx5_cmd_exec(). Signed-off-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-06-28Merge tag 'mlx5-fixes-2018-06-26' of ↵David S. Miller1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-fixes-2018-06-26 Fixes for mlx5 core and netdev driver: Two fixes from Alex Vesker to address command interface issues - Race in command interface polling mode - Incorrect raw command length parsing From Shay Agroskin, Fix wrong size allocation for QoS ETC TC regitster. From Or Gerlitz and Eli Cohin, Address backward compatability issues for when Eswitch capability is not advertised for the PF host driver - Fix required capability for manipulating MPFS - E-Switch, Disallow vlan/spoofcheck setup if not being esw manager - Avoid dealing with vport IB/eth representors if not being e-switch manager - E-Switch, Avoid setup attempt if not being e-switch manager - Don't attempt to dereference the ppriv struct if not being eswitch manager ==================== Signed-off-by: David S. Miller <[email protected]>
2018-06-27RDMA/vmw_pvrdma: Delete unused functionYuval Shaia1-5/+0
This function is not in use - delete it. Signed-off-by: Yuval Shaia <[email protected]> Acked-by: Adit Ranadive <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2018-06-26IB/mlx5: Avoid dealing with vport representors if not being e-switch managerOr Gerlitz1-1/+1
In smartnic env, the host (PF) driver might not be an e-switch manager, hence the switchdev mode representors are running on the embedded cpu (EC) and not at the host. As such, we should avoid dealing with vport representors if not being esw manager. Fixes: b5ca15ad7e61 ('IB/mlx5: Add proper representors support') Signed-off-by: Or Gerlitz <[email protected]> Reviewed-by: Eli Cohen <[email protected]> Signed-off-by: Saeed Mahameed <[email protected]>
2018-06-26IB/mlx4: Create slave AH's directlyJason Gunthorpe3-25/+59
Since slave GID's do not exist in the core gid table we can no longer use the core code to help do this without creating inconsistencies. Directly create the AH using mlx4 internal APIs. Signed-off-by: Jason Gunthorpe <[email protected]> Reviewed-by: Jack Morgenstein <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]>
2018-06-26IB/hfi1: Fix incorrect mixing of ERR_PTR and NULL return valuesMichael J. Ruhl5-9/+9
The __get_txreq() function can return a pointer, ERR_PTR(-EBUSY), or NULL. All of the relevant call sites look for IS_ERR, so the NULL return would lead to a NULL pointer exception. Do not use the ERR_PTR mechanism for this function. Update all call sites to handle the return value correctly. Clean up error paths to reflect return value. Fixes: 45842abbb292 ("staging/rdma/hfi1: move txreq header code") Cc: <[email protected]> # 4.9.x+ Reported-by: Dan Carpenter <[email protected]> Reviewed-by: Mike Marciniszyn <[email protected]> Reviewed-by: Kamenee Arumugam <[email protected]> Signed-off-by: Michael J. Ruhl <[email protected]> Signed-off-by: Dennis Dalessandro <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>