linux-toradex.git/drivers/infiniband, branch v3.2.7

RDMA/core: Fix kernel panic by always initializing qp->usecnt

2012-02-13T19:16:54+00:00

commit e47e321a35c741ee41b67976f8c6a3a7a42bc5c0 upstream.

We have just been investigating kernel panics related to
cq->ibcq.event_handler() completion calls.  The problem is that
ib_destroy_qp() fails with -EBUSY.

Further investigation revealed qp->usecnt is not initialized.  This
counter was introduced in linux-3.2 by commit 0e0ec7e0638e
("RDMA/core: Export ib_open_qp() to share XRC TGT QPs") but it only
gets initialized for IB_QPT_XRC_TGT, but it is checked in
ib_destroy_qp() for any QP type.

Fix this by initializing qp->usecnt for every QP we create.

Signed-off-by: Bernd Schubert 
Signed-off-by: Sven Breuner 

[ Initialize qp->usecnt in uverbs too.  - Sean ]

Signed-off-by: Sean Hefty 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

IB/mlx4: pass SMP vendor-specific attribute MADs to firmware

2012-02-13T19:16:53+00:00

commit a6f7feae6d19e84253918d88b04153af09d3a243 upstream.

In the current code, vendor-specific MADs (e.g with the FDR-10
attribute) are silently dropped by the driver, resulting in timeouts
at the sending side and inability to query/configure the relevant
feature.  However, the ConnectX firmware is able to handle such MADs.
For unsupported attributes, the firmware returns a GET_RESPONSE MAD
containing an error status.

For example, for a FDR-10 node with LID 11:

    # ibstat mlx4_0 1

    CA: 'mlx4_0'
    Port 1:
    State: Active
    Physical state: LinkUp
    Rate: 40 (FDR10)
    Base lid: 11
    LMC: 0
    SM lid: 24
    Capability mask: 0x02514868
    Port GUID: 0x0002c903002e65d1
    Link layer: InfiniBand

Extended Port Query (EPI) vendor mad timeouts before the patch:

    # smpquery MEPI 11 -d

    ibwarn: [4196] smp_query_via: attr 0xff90 mod 0x0 route Lid 11
    ibwarn: [4196] _do_madrpc: retry 1 (timeout 1000 ms)
    ibwarn: [4196] _do_madrpc: retry 2 (timeout 1000 ms)
    ibwarn: [4196] _do_madrpc: timeout after 3 retries, 3000 ms
    ibwarn: [4196] mad_rpc: _do_madrpc failed; dport (Lid 11)
    smpquery: iberror: [pid 4196] main: failed: operation EPI: ext port info query failed

EPI query works OK with the patch:

    # smpquery MEPI 11 -d

    ibwarn: [6548] smp_query_via: attr 0xff90 mod 0x0 route Lid 11
    ibwarn: [6548] mad_rpc: data offs 64 sz 64
    mad data
    0000 0000 0000 0001 0000 0001 0000 0001
    0000 0000 0000 0000 0000 0000 0000 0000
    0000 0000 0000 0000 0000 0000 0000 0000
    0000 0000 0000 0000 0000 0000 0000 0000
    # Ext Port info: Lid 11 port 0
    StateChangeEnable:...............0x00
    LinkSpeedSupported:..............0x01
    LinkSpeedEnabled:................0x01
    LinkSpeedActive:.................0x01

Signed-off-by: Jack Morgenstein 
Signed-off-by: Or Gerlitz 
Acked-by: Ira Weiny 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

IB/uverbs: Protect QP multicast list

2012-01-12T19:29:24+00:00

commit e214a0fe2b382fa302c036ecd6e6ffe99e3b9875 upstream.

Userspace verbs multicast attach/detach operations on a QP are done
while holding the rwsem of the QP for reading.  That's not sufficient
since a reader lock allows more than one reader to acquire the
lock.  However, multicast attach/detach does list manipulation that
can corrupt the list if multiple threads run in parallel.

Fix this by acquiring the rwsem as a writer to serialize attach/detach
operations.  Add idr_write_qp() and put_qp_write() to encapsulate
this.

This fixes oops seen when running applications that perform multicast
joins/leaves.

Reported by: Mike Dubman 
Signed-off-by: Eli Cohen 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

IB/qib: Fix a possible data corruption when receiving packets

2012-01-12T19:29:23+00:00

commit eddfb675256f49d14e8c5763098afe3eb2c93701 upstream.

Prevent a receive data corruption by ensuring that the write to update
the rcvhdrheadn register to generate an interrupt is at the very end
of the receive processing.

Signed-off-by: Ramkrishna Vepa 
Signed-off-by: Mike Marciniszyn 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

Merge branches 'cma', 'mlx4' and 'qib' into for-next

2011-12-19T17:19:49+00:00

IB/qib: Correct sense on freectxts increment and decrement

2011-12-19T17:19:34+00:00

Commit 53ab1c64983 ("IB/qib: Correct nfreectxts for multiple HCAs")
reversed the increments and decrements of dd->nfreectxts.  Fix it.

Reviewed-by: Ram Vepa 
Signed-off-by: Mike Marciniszyn 
Signed-off-by: Roland Dreier

RDMA/cma: Verify private data length

2011-12-19T17:15:33+00:00

private_data_len is defined as a u8.  If the user specifies a large
private_data size (> 220 bytes), we will calculate a total length that
exceeds 255, resulting in private_data_len wrapping back to 0.  This
can lead to overwriting random kernel memory.  Avoid this by verifying
that the resulting size fits into a u8.

Reported-by: B. Thery 
Addresses: 
Signed-off-by: Sean Hefty 
Signed-off-by: Roland Dreier

IB/mlx4: Fix shutdown crash accessing a non-existent bitmap

2011-12-06T18:47:37+00:00

Commit cfcde11c3d7a ("IB/mlx4: Use flow counters on IBoE ports") added
code that sets elements of counters[] to -1 if no counter is allocated,
but then goes ahead and passes every entry to mlx4_counter_free() on
shutdown.  This is a bad idea, especially if MLX4_DEV_CAP_FLAG_COUNTERS
isn't set so there isn't even an underlying bitmap to free from.

Tested-by: Sean Hefty 
Cc: 
Signed-off-by: Roland Dreier

Merge branches 'cxgb4', 'ipoib', 'misc' and 'qib' into for-next

2011-11-30T02:01:53+00:00

IB: Fix RCU lockdep splats

2011-11-29T21:37:11+00:00

Commit f2c31e32b37 ("net: fix NULL dereferences in check_peer_redir()")
forgot to take care of infiniband uses of dst neighbours.

Many thanks to Marc Aurele who provided a nice bug report and feedback.

Reported-by: Marc Aurele La France 
Signed-off-by: Eric Dumazet 
Cc: David Miller 
Cc: 
Signed-off-by: Roland Dreier