tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:
"Not too much going on here, though there are about four fixes related
to stuff merged during the last merge window.

We also see the return of a syzkaller instance with access to RDMA
devices, and a few bugs detected by that squished.

- Fix three crashers and a memory memory leak for HFI1

- Several bugs found by syzkaller

- A bug fix for the recent QP counters feature on older mlx5 HW

- Locking inversion in cxgb4

- Unnecessary WARN_ON in siw

- A umad crasher regression during unload, from a bug fix for
something else

- Bugs introduced in the merge window:
- Missed list_del in uverbs file rework, core and mlx5 devx
- Unexpected integer math truncation in the mlx5 VAR patches
- Compilation bug fix for the VAR patches on 32 bit"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
IB/mlx5: Use div64_u64 for num_var_hw_entries calculation
RDMA/core: Fix protection fault in get_pkey_idx_qp_list
RDMA/rxe: Fix soft lockup problem due to using tasklets in softirq
RDMA/mlx5: Prevent overflow in mmap offset calculations
IB/umad: Fix kernel crash while unloading ib_umad
RDMA/mlx5: Fix async events cleanup flows
RDMA/core: Add missing list deletion on freeing event queue
RDMA/siw: Remove unwanted WARN_ON in siw_cm_llp_data_ready()
RDMA/iw_cxgb4: initiate CLOSE when entering TERM
IB/mlx5: Return failure when rts2rts_qp_counters_set_id is not supported
RDMA/core: Fix invalid memory access in spec_filter_size
IB/rdmavt: Reset all QPs when the device is shut down
IB/hfi1: Close window for pq and request coliding
IB/hfi1: Acquire lock to release TID entries when user file is closed
RDMA/hfi1: Fix memory leak in _dev_comp_vect_mappings_create

Linus Torvalds 54654e14 b719ae07

+172 -125
+9 -15
drivers/infiniband/core/security.c
··· 339 339 if (!new_pps) 340 340 return NULL; 341 341 342 - if (qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) { 343 - if (!qp_pps) { 344 - new_pps->main.port_num = qp_attr->port_num; 345 - new_pps->main.pkey_index = qp_attr->pkey_index; 346 - } else { 347 - new_pps->main.port_num = (qp_attr_mask & IB_QP_PORT) ? 348 - qp_attr->port_num : 349 - qp_pps->main.port_num; 350 - 351 - new_pps->main.pkey_index = 352 - (qp_attr_mask & IB_QP_PKEY_INDEX) ? 353 - qp_attr->pkey_index : 354 - qp_pps->main.pkey_index; 355 - } 342 + if (qp_attr_mask & IB_QP_PORT) 343 + new_pps->main.port_num = 344 + (qp_pps) ? qp_pps->main.port_num : qp_attr->port_num; 345 + if (qp_attr_mask & IB_QP_PKEY_INDEX) 346 + new_pps->main.pkey_index = (qp_pps) ? qp_pps->main.pkey_index : 347 + qp_attr->pkey_index; 348 + if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT)) 356 349 new_pps->main.state = IB_PORT_PKEY_VALID; 357 - } else if (qp_pps) { 350 + 351 + if (!(qp_attr_mask & (IB_QP_PKEY_INDEX || IB_QP_PORT)) && qp_pps) { 358 352 new_pps->main.port_num = qp_pps->main.port_num; 359 353 new_pps->main.pkey_index = qp_pps->main.pkey_index; 360 354 if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID)
+3 -2
drivers/infiniband/core/user_mad.c
··· 1312 1312 struct ib_umad_file *file; 1313 1313 int id; 1314 1314 1315 + cdev_device_del(&port->sm_cdev, &port->sm_dev); 1316 + cdev_device_del(&port->cdev, &port->dev); 1317 + 1315 1318 mutex_lock(&port->file_mutex); 1316 1319 1317 1320 /* Mark ib_dev NULL and block ioctl or other file ops to progress ··· 1334 1331 1335 1332 mutex_unlock(&port->file_mutex); 1336 1333 1337 - cdev_device_del(&port->sm_cdev, &port->sm_dev); 1338 - cdev_device_del(&port->cdev, &port->dev); 1339 1334 ida_free(&umad_ida, port->dev_num); 1340 1335 1341 1336 /* balances device_initialize() */
+7 -8
drivers/infiniband/core/uverbs_cmd.c
··· 2745 2745 return 0; 2746 2746 } 2747 2747 2748 - static size_t kern_spec_filter_sz(const struct ib_uverbs_flow_spec_hdr *spec) 2749 - { 2750 - /* Returns user space filter size, includes padding */ 2751 - return (spec->size - sizeof(struct ib_uverbs_flow_spec_hdr)) / 2; 2752 - } 2753 - 2754 2748 static ssize_t spec_filter_size(const void *kern_spec_filter, u16 kern_filter_size, 2755 2749 u16 ib_real_filter_sz) 2756 2750 { ··· 2888 2894 static int kern_spec_to_ib_spec_filter(struct ib_uverbs_flow_spec *kern_spec, 2889 2895 union ib_flow_spec *ib_spec) 2890 2896 { 2891 - ssize_t kern_filter_sz; 2897 + size_t kern_filter_sz; 2892 2898 void *kern_spec_mask; 2893 2899 void *kern_spec_val; 2894 2900 2895 - kern_filter_sz = kern_spec_filter_sz(&kern_spec->hdr); 2901 + if (check_sub_overflow((size_t)kern_spec->hdr.size, 2902 + sizeof(struct ib_uverbs_flow_spec_hdr), 2903 + &kern_filter_sz)) 2904 + return -EINVAL; 2905 + 2906 + kern_filter_sz /= 2; 2896 2907 2897 2908 kern_spec_val = (void *)kern_spec + 2898 2909 sizeof(struct ib_uverbs_flow_spec_hdr);
+1
drivers/infiniband/core/uverbs_std_types.c
··· 220 220 list_for_each_entry_safe(entry, tmp, &event_queue->event_list, list) { 221 221 if (entry->counter) 222 222 list_del(&entry->obj_list); 223 + list_del(&entry->list); 223 224 kfree(entry); 224 225 } 225 226 spin_unlock_irq(&event_queue->lock);
+4
drivers/infiniband/hw/cxgb4/cm.c
··· 3036 3036 C4IW_QP_ATTR_NEXT_STATE, &attrs, 1); 3037 3037 } 3038 3038 3039 + /* As per draft-hilland-iwarp-verbs-v1.0, sec 6.2.3, 3040 + * when entering the TERM state the RNIC MUST initiate a CLOSE. 3041 + */ 3042 + c4iw_ep_disconnect(ep, 1, GFP_KERNEL); 3039 3043 c4iw_put_ep(&ep->com); 3040 3044 } else 3041 3045 pr_warn("TERM received tid %u no ep/qp\n", tid);
+2 -2
drivers/infiniband/hw/cxgb4/qp.c
··· 1948 1948 qhp->attr.layer_etype = attrs->layer_etype; 1949 1949 qhp->attr.ecode = attrs->ecode; 1950 1950 ep = qhp->ep; 1951 - c4iw_get_ep(&ep->com); 1952 - disconnect = 1; 1953 1951 if (!internal) { 1952 + c4iw_get_ep(&ep->com); 1954 1953 terminate = 1; 1954 + disconnect = 1; 1955 1955 } else { 1956 1956 terminate = qhp->attr.send_term; 1957 1957 ret = rdma_fini(rhp, qhp, ep);
+2
drivers/infiniband/hw/hfi1/affinity.c
··· 479 479 rvt_get_ibdev_name(&(dd)->verbs_dev.rdi), i, cpu); 480 480 } 481 481 482 + free_cpumask_var(available_cpus); 483 + free_cpumask_var(non_intr_cpus); 482 484 return 0; 483 485 484 486 fail:
+32 -20
drivers/infiniband/hw/hfi1/file_ops.c
··· 200 200 201 201 fd = kzalloc(sizeof(*fd), GFP_KERNEL); 202 202 203 - if (fd) { 204 - fd->rec_cpu_num = -1; /* no cpu affinity by default */ 205 - fd->mm = current->mm; 206 - mmgrab(fd->mm); 207 - fd->dd = dd; 208 - kobject_get(&fd->dd->kobj); 209 - fp->private_data = fd; 210 - } else { 211 - fp->private_data = NULL; 212 - 213 - if (atomic_dec_and_test(&dd->user_refcount)) 214 - complete(&dd->user_comp); 215 - 216 - return -ENOMEM; 217 - } 218 - 203 + if (!fd || init_srcu_struct(&fd->pq_srcu)) 204 + goto nomem; 205 + spin_lock_init(&fd->pq_rcu_lock); 206 + spin_lock_init(&fd->tid_lock); 207 + spin_lock_init(&fd->invalid_lock); 208 + fd->rec_cpu_num = -1; /* no cpu affinity by default */ 209 + fd->mm = current->mm; 210 + mmgrab(fd->mm); 211 + fd->dd = dd; 212 + kobject_get(&fd->dd->kobj); 213 + fp->private_data = fd; 219 214 return 0; 215 + nomem: 216 + kfree(fd); 217 + fp->private_data = NULL; 218 + if (atomic_dec_and_test(&dd->user_refcount)) 219 + complete(&dd->user_comp); 220 + return -ENOMEM; 220 221 } 221 222 222 223 static long hfi1_file_ioctl(struct file *fp, unsigned int cmd, ··· 302 301 static ssize_t hfi1_write_iter(struct kiocb *kiocb, struct iov_iter *from) 303 302 { 304 303 struct hfi1_filedata *fd = kiocb->ki_filp->private_data; 305 - struct hfi1_user_sdma_pkt_q *pq = fd->pq; 304 + struct hfi1_user_sdma_pkt_q *pq; 306 305 struct hfi1_user_sdma_comp_q *cq = fd->cq; 307 306 int done = 0, reqs = 0; 308 307 unsigned long dim = from->nr_segs; 308 + int idx; 309 309 310 - if (!cq || !pq) 310 + idx = srcu_read_lock(&fd->pq_srcu); 311 + pq = srcu_dereference(fd->pq, &fd->pq_srcu); 312 + if (!cq || !pq) { 313 + srcu_read_unlock(&fd->pq_srcu, idx); 311 314 return -EIO; 315 + } 312 316 313 - if (!iter_is_iovec(from) || !dim) 317 + if (!iter_is_iovec(from) || !dim) { 318 + srcu_read_unlock(&fd->pq_srcu, idx); 314 319 return -EINVAL; 320 + } 315 321 316 322 trace_hfi1_sdma_request(fd->dd, fd->uctxt->ctxt, fd->subctxt, dim); 317 323 318 - if (atomic_read(&pq->n_reqs) == pq->n_max_reqs) 324 + if (atomic_read(&pq->n_reqs) == pq->n_max_reqs) { 325 + srcu_read_unlock(&fd->pq_srcu, idx); 319 326 return -ENOSPC; 327 + } 320 328 321 329 while (dim) { 322 330 int ret; ··· 343 333 reqs++; 344 334 } 345 335 336 + srcu_read_unlock(&fd->pq_srcu, idx); 346 337 return reqs; 347 338 } 348 339 ··· 718 707 if (atomic_dec_and_test(&dd->user_refcount)) 719 708 complete(&dd->user_comp); 720 709 710 + cleanup_srcu_struct(&fdata->pq_srcu); 721 711 kfree(fdata); 722 712 return 0; 723 713 }
+4 -1
drivers/infiniband/hw/hfi1/hfi.h
··· 1444 1444 1445 1445 /* Private data for file operations */ 1446 1446 struct hfi1_filedata { 1447 + struct srcu_struct pq_srcu; 1447 1448 struct hfi1_devdata *dd; 1448 1449 struct hfi1_ctxtdata *uctxt; 1449 1450 struct hfi1_user_sdma_comp_q *cq; 1450 - struct hfi1_user_sdma_pkt_q *pq; 1451 + /* update side lock for SRCU */ 1452 + spinlock_t pq_rcu_lock; 1453 + struct hfi1_user_sdma_pkt_q __rcu *pq; 1451 1454 u16 subctxt; 1452 1455 /* for cpu affinity; -1 if none */ 1453 1456 int rec_cpu_num;
+2 -3
drivers/infiniband/hw/hfi1/user_exp_rcv.c
··· 87 87 { 88 88 int ret = 0; 89 89 90 - spin_lock_init(&fd->tid_lock); 91 - spin_lock_init(&fd->invalid_lock); 92 - 93 90 fd->entry_to_rb = kcalloc(uctxt->expected_count, 94 91 sizeof(struct rb_node *), 95 92 GFP_KERNEL); ··· 139 142 { 140 143 struct hfi1_ctxtdata *uctxt = fd->uctxt; 141 144 145 + mutex_lock(&uctxt->exp_mutex); 142 146 if (!EXP_TID_SET_EMPTY(uctxt->tid_full_list)) 143 147 unlock_exp_tids(uctxt, &uctxt->tid_full_list, fd); 144 148 if (!EXP_TID_SET_EMPTY(uctxt->tid_used_list)) 145 149 unlock_exp_tids(uctxt, &uctxt->tid_used_list, fd); 150 + mutex_unlock(&uctxt->exp_mutex); 146 151 147 152 kfree(fd->invalid_tids); 148 153 fd->invalid_tids = NULL;
+12 -5
drivers/infiniband/hw/hfi1/user_sdma.c
··· 179 179 pq = kzalloc(sizeof(*pq), GFP_KERNEL); 180 180 if (!pq) 181 181 return -ENOMEM; 182 - 183 182 pq->dd = dd; 184 183 pq->ctxt = uctxt->ctxt; 185 184 pq->subctxt = fd->subctxt; ··· 235 236 goto pq_mmu_fail; 236 237 } 237 238 238 - fd->pq = pq; 239 + rcu_assign_pointer(fd->pq, pq); 239 240 fd->cq = cq; 240 241 241 242 return 0; ··· 263 264 264 265 trace_hfi1_sdma_user_free_queues(uctxt->dd, uctxt->ctxt, fd->subctxt); 265 266 266 - pq = fd->pq; 267 + spin_lock(&fd->pq_rcu_lock); 268 + pq = srcu_dereference_check(fd->pq, &fd->pq_srcu, 269 + lockdep_is_held(&fd->pq_rcu_lock)); 267 270 if (pq) { 271 + rcu_assign_pointer(fd->pq, NULL); 272 + spin_unlock(&fd->pq_rcu_lock); 273 + synchronize_srcu(&fd->pq_srcu); 274 + /* at this point there can be no more new requests */ 268 275 if (pq->handler) 269 276 hfi1_mmu_rb_unregister(pq->handler); 270 277 iowait_sdma_drain(&pq->busy); ··· 282 277 kfree(pq->req_in_use); 283 278 kmem_cache_destroy(pq->txreq_cache); 284 279 kfree(pq); 285 - fd->pq = NULL; 280 + } else { 281 + spin_unlock(&fd->pq_rcu_lock); 286 282 } 287 283 if (fd->cq) { 288 284 vfree(fd->cq->comps); ··· 327 321 { 328 322 int ret = 0, i; 329 323 struct hfi1_ctxtdata *uctxt = fd->uctxt; 330 - struct hfi1_user_sdma_pkt_q *pq = fd->pq; 324 + struct hfi1_user_sdma_pkt_q *pq = 325 + srcu_dereference(fd->pq, &fd->pq_srcu); 331 326 struct hfi1_user_sdma_comp_q *cq = fd->cq; 332 327 struct hfi1_devdata *dd = pq->dd; 333 328 unsigned long idx = 0;
+28 -23
drivers/infiniband/hw/mlx5/devx.c
··· 2319 2319 2320 2320 if (ev_file->omit_data) { 2321 2321 spin_lock_irqsave(&ev_file->lock, flags); 2322 - if (!list_empty(&event_sub->event_list)) { 2322 + if (!list_empty(&event_sub->event_list) || 2323 + ev_file->is_destroyed) { 2323 2324 spin_unlock_irqrestore(&ev_file->lock, flags); 2324 2325 return 0; 2325 2326 } 2326 2327 2327 - /* is_destroyed is ignored here because we don't have any memory 2328 - * allocation to clean up for the omit_data case 2329 - */ 2330 2328 list_add_tail(&event_sub->event_list, &ev_file->event_list); 2331 2329 spin_unlock_irqrestore(&ev_file->lock, flags); 2332 2330 wake_up_interruptible(&ev_file->poll_wait); ··· 2471 2473 return -ERESTARTSYS; 2472 2474 } 2473 2475 2474 - if (list_empty(&ev_queue->event_list) && 2475 - ev_queue->is_destroyed) 2476 - return -EIO; 2477 - 2478 2476 spin_lock_irq(&ev_queue->lock); 2477 + if (ev_queue->is_destroyed) { 2478 + spin_unlock_irq(&ev_queue->lock); 2479 + return -EIO; 2480 + } 2479 2481 } 2480 2482 2481 2483 event = list_entry(ev_queue->event_list.next, ··· 2549 2551 return -EOVERFLOW; 2550 2552 } 2551 2553 2552 - if (ev_file->is_destroyed) { 2553 - spin_unlock_irq(&ev_file->lock); 2554 - return -EIO; 2555 - } 2556 2554 2557 2555 while (list_empty(&ev_file->event_list)) { 2558 2556 spin_unlock_irq(&ev_file->lock); ··· 2661 2667 2662 2668 spin_lock_irq(&comp_ev_file->ev_queue.lock); 2663 2669 list_for_each_entry_safe(entry, tmp, 2664 - &comp_ev_file->ev_queue.event_list, list) 2670 + &comp_ev_file->ev_queue.event_list, list) { 2671 + list_del(&entry->list); 2665 2672 kvfree(entry); 2673 + } 2666 2674 spin_unlock_irq(&comp_ev_file->ev_queue.lock); 2667 2675 return 0; 2668 2676 }; ··· 2676 2680 container_of(uobj, struct devx_async_event_file, 2677 2681 uobj); 2678 2682 struct devx_event_subscription *event_sub, *event_sub_tmp; 2679 - struct devx_async_event_data *entry, *tmp; 2680 2683 struct mlx5_ib_dev *dev = ev_file->dev; 2681 2684 2682 2685 spin_lock_irq(&ev_file->lock); 2683 2686 ev_file->is_destroyed = 1; 2687 + 2688 + /* free the pending events allocation */ 2689 + if (ev_file->omit_data) { 2690 + struct devx_event_subscription *event_sub, *tmp; 2691 + 2692 + list_for_each_entry_safe(event_sub, tmp, &ev_file->event_list, 2693 + event_list) 2694 + list_del_init(&event_sub->event_list); 2695 + 2696 + } else { 2697 + struct devx_async_event_data *entry, *tmp; 2698 + 2699 + list_for_each_entry_safe(entry, tmp, &ev_file->event_list, 2700 + list) { 2701 + list_del(&entry->list); 2702 + kfree(entry); 2703 + } 2704 + } 2705 + 2684 2706 spin_unlock_irq(&ev_file->lock); 2685 2707 wake_up_interruptible(&ev_file->poll_wait); 2686 2708 ··· 2712 2698 call_rcu(&event_sub->rcu, devx_free_subscription); 2713 2699 } 2714 2700 mutex_unlock(&dev->devx_event_table.event_xa_lock); 2715 - 2716 - /* free the pending events allocation */ 2717 - if (!ev_file->omit_data) { 2718 - spin_lock_irq(&ev_file->lock); 2719 - list_for_each_entry_safe(entry, tmp, 2720 - &ev_file->event_list, list) 2721 - kfree(entry); /* read can't come any more */ 2722 - spin_unlock_irq(&ev_file->lock); 2723 - } 2724 2701 2725 2702 put_device(&dev->ib_dev.dev); 2726 2703 return 0;
+3 -3
drivers/infiniband/hw/mlx5/main.c
··· 2283 2283 2284 2284 static u64 mlx5_entry_to_mmap_offset(struct mlx5_user_mmap_entry *entry) 2285 2285 { 2286 - u16 cmd = entry->rdma_entry.start_pgoff >> 16; 2287 - u16 index = entry->rdma_entry.start_pgoff & 0xFFFF; 2286 + u64 cmd = (entry->rdma_entry.start_pgoff >> 16) & 0xFFFF; 2287 + u64 index = entry->rdma_entry.start_pgoff & 0xFFFF; 2288 2288 2289 2289 return (((index >> 8) << 16) | (cmd << MLX5_IB_MMAP_CMD_SHIFT) | 2290 2290 (index & 0xFF)) << PAGE_SHIFT; ··· 6545 6545 doorbell_bar_offset); 6546 6546 bar_size = (1ULL << log_doorbell_bar_size) * 4096; 6547 6547 var_table->stride_size = 1ULL << log_doorbell_stride; 6548 - var_table->num_var_hw_entries = bar_size / var_table->stride_size; 6548 + var_table->num_var_hw_entries = div64_u64(bar_size, var_table->stride_size); 6549 6549 mutex_init(&var_table->bitmap_lock); 6550 6550 var_table->bitmap = bitmap_zalloc(var_table->num_var_hw_entries, 6551 6551 GFP_KERNEL);
+6 -3
drivers/infiniband/hw/mlx5/qp.c
··· 3441 3441 struct mlx5_ib_qp_base *base; 3442 3442 u32 set_id; 3443 3443 3444 - if (!MLX5_CAP_GEN(dev->mdev, rts2rts_qp_counters_set_id)) 3445 - return 0; 3446 - 3447 3444 if (counter) 3448 3445 set_id = counter->id; 3449 3446 else ··· 6573 6576 */ 6574 6577 int mlx5_ib_qp_set_counter(struct ib_qp *qp, struct rdma_counter *counter) 6575 6578 { 6579 + struct mlx5_ib_dev *dev = to_mdev(qp->device); 6576 6580 struct mlx5_ib_qp *mqp = to_mqp(qp); 6577 6581 int err = 0; 6578 6582 6579 6583 mutex_lock(&mqp->mutex); 6580 6584 if (mqp->state == IB_QPS_RESET) { 6581 6585 qp->counter = counter; 6586 + goto out; 6587 + } 6588 + 6589 + if (!MLX5_CAP_GEN(dev->mdev, rts2rts_qp_counters_set_id)) { 6590 + err = -EOPNOTSUPP; 6582 6591 goto out; 6583 6592 } 6584 6593
+51 -33
drivers/infiniband/sw/rdmavt/qp.c
··· 61 61 #define RVT_RWQ_COUNT_THRESHOLD 16 62 62 63 63 static void rvt_rc_timeout(struct timer_list *t); 64 + static void rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp, 65 + enum ib_qp_type type); 64 66 65 67 /* 66 68 * Convert the AETH RNR timeout code into the number of microseconds. ··· 454 452 } 455 453 456 454 /** 457 - * free_all_qps - check for QPs still in use 455 + * rvt_free_qp_cb - callback function to reset a qp 456 + * @qp: the qp to reset 457 + * @v: a 64-bit value 458 + * 459 + * This function resets the qp and removes it from the 460 + * qp hash table. 461 + */ 462 + static void rvt_free_qp_cb(struct rvt_qp *qp, u64 v) 463 + { 464 + unsigned int *qp_inuse = (unsigned int *)v; 465 + struct rvt_dev_info *rdi = ib_to_rvt(qp->ibqp.device); 466 + 467 + /* Reset the qp and remove it from the qp hash list */ 468 + rvt_reset_qp(rdi, qp, qp->ibqp.qp_type); 469 + 470 + /* Increment the qp_inuse count */ 471 + (*qp_inuse)++; 472 + } 473 + 474 + /** 475 + * rvt_free_all_qps - check for QPs still in use 458 476 * @rdi: rvt device info structure 459 477 * 460 478 * There should not be any QPs still in use. 461 479 * Free memory for table. 480 + * Return the number of QPs still in use. 462 481 */ 463 482 static unsigned rvt_free_all_qps(struct rvt_dev_info *rdi) 464 483 { 465 - unsigned long flags; 466 - struct rvt_qp *qp; 467 - unsigned n, qp_inuse = 0; 468 - spinlock_t *ql; /* work around too long line below */ 469 - 470 - if (rdi->driver_f.free_all_qps) 471 - qp_inuse = rdi->driver_f.free_all_qps(rdi); 484 + unsigned int qp_inuse = 0; 472 485 473 486 qp_inuse += rvt_mcast_tree_empty(rdi); 474 487 475 - if (!rdi->qp_dev) 476 - return qp_inuse; 488 + rvt_qp_iter(rdi, (u64)&qp_inuse, rvt_free_qp_cb); 477 489 478 - ql = &rdi->qp_dev->qpt_lock; 479 - spin_lock_irqsave(ql, flags); 480 - for (n = 0; n < rdi->qp_dev->qp_table_size; n++) { 481 - qp = rcu_dereference_protected(rdi->qp_dev->qp_table[n], 482 - lockdep_is_held(ql)); 483 - RCU_INIT_POINTER(rdi->qp_dev->qp_table[n], NULL); 484 - 485 - for (; qp; qp = rcu_dereference_protected(qp->next, 486 - lockdep_is_held(ql))) 487 - qp_inuse++; 488 - } 489 - spin_unlock_irqrestore(ql, flags); 490 - synchronize_rcu(); 491 490 return qp_inuse; 492 491 } 493 492 ··· 905 902 } 906 903 907 904 /** 908 - * rvt_reset_qp - initialize the QP state to the reset state 905 + * _rvt_reset_qp - initialize the QP state to the reset state 909 906 * @qp: the QP to reset 910 907 * @type: the QP type 911 908 * 912 909 * r_lock, s_hlock, and s_lock are required to be held by the caller 913 910 */ 914 - static void rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp, 915 - enum ib_qp_type type) 911 + static void _rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp, 912 + enum ib_qp_type type) 916 913 __must_hold(&qp->s_lock) 917 914 __must_hold(&qp->s_hlock) 918 915 __must_hold(&qp->r_lock) ··· 956 953 lockdep_assert_held(&qp->r_lock); 957 954 lockdep_assert_held(&qp->s_hlock); 958 955 lockdep_assert_held(&qp->s_lock); 956 + } 957 + 958 + /** 959 + * rvt_reset_qp - initialize the QP state to the reset state 960 + * @rdi: the device info 961 + * @qp: the QP to reset 962 + * @type: the QP type 963 + * 964 + * This is the wrapper function to acquire the r_lock, s_hlock, and s_lock 965 + * before calling _rvt_reset_qp(). 966 + */ 967 + static void rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp, 968 + enum ib_qp_type type) 969 + { 970 + spin_lock_irq(&qp->r_lock); 971 + spin_lock(&qp->s_hlock); 972 + spin_lock(&qp->s_lock); 973 + _rvt_reset_qp(rdi, qp, type); 974 + spin_unlock(&qp->s_lock); 975 + spin_unlock(&qp->s_hlock); 976 + spin_unlock_irq(&qp->r_lock); 959 977 } 960 978 961 979 /** rvt_free_qpn - Free a qpn from the bit map ··· 1570 1546 switch (new_state) { 1571 1547 case IB_QPS_RESET: 1572 1548 if (qp->state != IB_QPS_RESET) 1573 - rvt_reset_qp(rdi, qp, ibqp->qp_type); 1549 + _rvt_reset_qp(rdi, qp, ibqp->qp_type); 1574 1550 break; 1575 1551 1576 1552 case IB_QPS_RTR: ··· 1719 1695 struct rvt_qp *qp = ibqp_to_rvtqp(ibqp); 1720 1696 struct rvt_dev_info *rdi = ib_to_rvt(ibqp->device); 1721 1697 1722 - spin_lock_irq(&qp->r_lock); 1723 - spin_lock(&qp->s_hlock); 1724 - spin_lock(&qp->s_lock); 1725 1698 rvt_reset_qp(rdi, qp, ibqp->qp_type); 1726 - spin_unlock(&qp->s_lock); 1727 - spin_unlock(&qp->s_hlock); 1728 - spin_unlock_irq(&qp->r_lock); 1729 1699 1730 1700 wait_event(qp->wait, !atomic_read(&qp->refcount)); 1731 1701 /* qpn is now available for use again */
+4 -4
drivers/infiniband/sw/rxe/rxe_comp.c
··· 329 329 qp->comp.psn = pkt->psn; 330 330 if (qp->req.wait_psn) { 331 331 qp->req.wait_psn = 0; 332 - rxe_run_task(&qp->req.task, 1); 332 + rxe_run_task(&qp->req.task, 0); 333 333 } 334 334 } 335 335 return COMPST_ERROR_RETRY; ··· 463 463 */ 464 464 if (qp->req.wait_fence) { 465 465 qp->req.wait_fence = 0; 466 - rxe_run_task(&qp->req.task, 1); 466 + rxe_run_task(&qp->req.task, 0); 467 467 } 468 468 } 469 469 ··· 479 479 if (qp->req.need_rd_atomic) { 480 480 qp->comp.timeout_retry = 0; 481 481 qp->req.need_rd_atomic = 0; 482 - rxe_run_task(&qp->req.task, 1); 482 + rxe_run_task(&qp->req.task, 0); 483 483 } 484 484 } 485 485 ··· 725 725 RXE_CNT_COMP_RETRY); 726 726 qp->req.need_retry = 1; 727 727 qp->comp.started_retry = 1; 728 - rxe_run_task(&qp->req.task, 1); 728 + rxe_run_task(&qp->req.task, 0); 729 729 } 730 730 731 731 if (pkt) {
+2 -3
drivers/infiniband/sw/siw/siw_cm.c
··· 1225 1225 read_lock(&sk->sk_callback_lock); 1226 1226 1227 1227 cep = sk_to_cep(sk); 1228 - if (!cep) { 1229 - WARN_ON(1); 1228 + if (!cep) 1230 1229 goto out; 1231 - } 1230 + 1232 1231 siw_dbg_cep(cep, "state: %d\n", cep->state); 1233 1232 1234 1233 switch (cep->state) {