Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma into master
Pull rdma fixes from Jason Gunthorpe:
"One merge window regression, some corruption bugs in HNS and a few
more syzkaller fixes:
- Two long standing syzkaller races
- Fix incorrect HW configuration in HNS
- Restore accidentally dropped locking in IB CM
- Fix ODP prefetch bug added in the big rework several versions ago"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
RDMA/mlx5: Prevent prefetch from racing with implicit destruction
RDMA/cm: Protect access to remote_sidr_table
RDMA/core: Fix race in rdma_alloc_commit_uobject()
RDMA/hns: Fix wrong PBL offset when VA is not aligned to PAGE_SIZE
RDMA/hns: Fix wrong assignment of lp_pktn_ini in QPC
RDMA/mlx5: Use xa_lock_irq when access to SRQ table
+49
-21
+2
drivers/infiniband/core/cm.c
+2
drivers/infiniband/core/cm.c
···
3676
3676
return ret;
3677
3677
}
3678
3678
cm_id_priv->id.state = IB_CM_IDLE;
3679
+
spin_lock_irq(&cm.lock);
3679
3680
if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) {
3680
3681
rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
3681
3682
RB_CLEAR_NODE(&cm_id_priv->sidr_id_node);
3682
3683
}
3684
+
spin_unlock_irq(&cm.lock);
3683
3685
return 0;
3684
3686
}
3685
3687
+3
-3
drivers/infiniband/core/rdma_core.c
+3
-3
drivers/infiniband/core/rdma_core.c
···
649
649
{
650
650
struct ib_uverbs_file *ufile = attrs->ufile;
651
651
652
-
/* alloc_commit consumes the uobj kref */
653
-
uobj->uapi_object->type_class->alloc_commit(uobj);
654
-
655
652
/* kref is held so long as the uobj is on the uobj list. */
656
653
uverbs_uobject_get(uobj);
657
654
spin_lock_irq(&ufile->uobjects_lock);
···
657
660
658
661
/* matches atomic_set(-1) in alloc_uobj */
659
662
atomic_set(&uobj->usecnt, 0);
663
+
664
+
/* alloc_commit consumes the uobj kref */
665
+
uobj->uapi_object->type_class->alloc_commit(uobj);
660
666
661
667
/* Matches the down_read in rdma_alloc_begin_uobject */
662
668
up_read(&ufile->hw_destroy_rwsem);
+22
-12
drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+22
-12
drivers/infiniband/hw/hns/hns_roce_hw_v2.c
···
3954
3954
return 0;
3955
3955
}
3956
3956
3957
+
static inline enum ib_mtu get_mtu(struct ib_qp *ibqp,
3958
+
const struct ib_qp_attr *attr)
3959
+
{
3960
+
if (ibqp->qp_type == IB_QPT_GSI || ibqp->qp_type == IB_QPT_UD)
3961
+
return IB_MTU_4096;
3962
+
3963
+
return attr->path_mtu;
3964
+
}
3965
+
3957
3966
static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
3958
3967
const struct ib_qp_attr *attr, int attr_mask,
3959
3968
struct hns_roce_v2_qp_context *context,
···
3974
3965
struct ib_device *ibdev = &hr_dev->ib_dev;
3975
3966
dma_addr_t trrl_ba;
3976
3967
dma_addr_t irrl_ba;
3968
+
enum ib_mtu mtu;
3977
3969
u8 port_num;
3978
3970
u64 *mtts;
3979
3971
u8 *dmac;
···
4072
4062
roce_set_field(qpc_mask->byte_52_udpspn_dmac, V2_QPC_BYTE_52_DMAC_M,
4073
4063
V2_QPC_BYTE_52_DMAC_S, 0);
4074
4064
4075
-
/* mtu*(2^LP_PKTN_INI) should not bigger than 1 message length 64kb */
4065
+
mtu = get_mtu(ibqp, attr);
4066
+
4067
+
if (attr_mask & IB_QP_PATH_MTU) {
4068
+
roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_MTU_M,
4069
+
V2_QPC_BYTE_24_MTU_S, mtu);
4070
+
roce_set_field(qpc_mask->byte_24_mtu_tc, V2_QPC_BYTE_24_MTU_M,
4071
+
V2_QPC_BYTE_24_MTU_S, 0);
4072
+
}
4073
+
4074
+
#define MAX_LP_MSG_LEN 65536
4075
+
/* MTU*(2^LP_PKTN_INI) shouldn't be bigger than 64kb */
4076
4076
roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_LP_PKTN_INI_M,
4077
4077
V2_QPC_BYTE_56_LP_PKTN_INI_S,
4078
-
ilog2(hr_dev->caps.max_sq_inline / IB_MTU_4096));
4078
+
ilog2(MAX_LP_MSG_LEN / ib_mtu_enum_to_int(mtu)));
4079
4079
roce_set_field(qpc_mask->byte_56_dqpn_err, V2_QPC_BYTE_56_LP_PKTN_INI_M,
4080
4080
V2_QPC_BYTE_56_LP_PKTN_INI_S, 0);
4081
-
4082
-
if (ibqp->qp_type == IB_QPT_GSI || ibqp->qp_type == IB_QPT_UD)
4083
-
roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_MTU_M,
4084
-
V2_QPC_BYTE_24_MTU_S, IB_MTU_4096);
4085
-
else if (attr_mask & IB_QP_PATH_MTU)
4086
-
roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_MTU_M,
4087
-
V2_QPC_BYTE_24_MTU_S, attr->path_mtu);
4088
-
4089
-
roce_set_field(qpc_mask->byte_24_mtu_tc, V2_QPC_BYTE_24_MTU_M,
4090
-
V2_QPC_BYTE_24_MTU_S, 0);
4091
4081
4092
4082
roce_set_bit(qpc_mask->byte_108_rx_reqepsn,
4093
4083
V2_QPC_BYTE_108_RX_REQ_PSN_ERR_S, 0);
+1
-1
drivers/infiniband/hw/hns/hns_roce_mr.c
+1
-1
drivers/infiniband/hw/hns/hns_roce_mr.c
···
120
120
121
121
mr->pbl_hop_num = is_fast ? 1 : hr_dev->caps.pbl_hop_num;
122
122
buf_attr.page_shift = is_fast ? PAGE_SHIFT :
123
-
hr_dev->caps.pbl_buf_pg_sz + HNS_HW_PAGE_SHIFT;
123
+
hr_dev->caps.pbl_buf_pg_sz + PAGE_SHIFT;
124
124
buf_attr.region[0].size = length;
125
125
buf_attr.region[0].hopnum = mr->pbl_hop_num;
126
126
buf_attr.region_count = 1;
+19
-3
drivers/infiniband/hw/mlx5/odp.c
+19
-3
drivers/infiniband/hw/mlx5/odp.c
···
601
601
*/
602
602
synchronize_srcu(&dev->odp_srcu);
603
603
604
+
/*
605
+
* All work on the prefetch list must be completed, xa_erase() prevented
606
+
* new work from being created.
607
+
*/
608
+
wait_event(imr->q_deferred_work, !atomic_read(&imr->num_deferred_work));
609
+
610
+
/*
611
+
* At this point it is forbidden for any other thread to enter
612
+
* pagefault_mr() on this imr. It is already forbidden to call
613
+
* pagefault_mr() on an implicit child. Due to this additions to
614
+
* implicit_children are prevented.
615
+
*/
616
+
617
+
/*
618
+
* Block destroy_unused_implicit_child_mr() from incrementing
619
+
* num_deferred_work.
620
+
*/
604
621
xa_lock(&imr->implicit_children);
605
622
xa_for_each (&imr->implicit_children, idx, mtt) {
606
623
__xa_erase(&imr->implicit_children, idx);
···
626
609
xa_unlock(&imr->implicit_children);
627
610
628
611
/*
629
-
* num_deferred_work can only be incremented inside the odp_srcu, or
630
-
* under xa_lock while the child is in the xarray. Thus at this point
631
-
* it is only decreasing, and all work holding it is now on the wq.
612
+
* Wait for any concurrent destroy_unused_implicit_child_mr() to
613
+
* complete.
632
614
*/
633
615
wait_event(imr->q_deferred_work, !atomic_read(&imr->num_deferred_work));
634
616
+2
-2
drivers/infiniband/hw/mlx5/srq_cmd.c
+2
-2
drivers/infiniband/hw/mlx5/srq_cmd.c
···
83
83
struct mlx5_srq_table *table = &dev->srq_table;
84
84
struct mlx5_core_srq *srq;
85
85
86
-
xa_lock(&table->array);
86
+
xa_lock_irq(&table->array);
87
87
srq = xa_load(&table->array, srqn);
88
88
if (srq)
89
89
refcount_inc(&srq->common.refcount);
90
-
xa_unlock(&table->array);
90
+
xa_unlock_irq(&table->array);
91
91
92
92
return srq;
93
93
}