Commit 5ad58728 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  MAINTAINERS: neteffect update
  RDMA/nes: Fix interrupt moderation low threshold
  RDMA/nes: Fix CRC endianness for RDMA connection establishment on big-endian
  RDMA/nes: Fix use-after-free in mini_cm_dec_refcnt_listen()
  RDMA/nes: Fix use-after-free in nes_create_cq()
  RDMA/nes: Fix a check-after-use in nes_probe()
  RDMA/nes: Fix a memory leak in schedule_nes_timer()
  RDMA/nes: Fix off-by-one
  RDMA/nes: Resurrect error path dead code
  RDMA/cxgb3: Fix shift calc in build_phys_page_list() for 1-entry page lists
parents f511d7ed 030f1b2f
......@@ -2744,6 +2744,8 @@ S: Maintained
NETEFFECT IWARP RNIC DRIVER (IW_NES)
P: Faisal Latif
M: flatif@neteffect.com
P: Nishi Gupta
M: ngupta@neteffect.com
P: Glenn Streiff
M: gstreiff@neteffect.com
L: general@lists.openfabrics.org
......
......@@ -136,14 +136,8 @@ int build_phys_page_list(struct ib_phys_buf *buffer_list,
/* Find largest page shift we can use to cover buffers */
for (*shift = PAGE_SHIFT; *shift < 27; ++(*shift))
if (num_phys_buf > 1) {
if ((1ULL << *shift) & mask)
break;
} else
if (1ULL << *shift >=
buffer_list[0].size +
(buffer_list[0].addr & ((1ULL << *shift) - 1)))
break;
if ((1ULL << *shift) & mask)
break;
buffer_list[0].size += buffer_list[0].addr & ((1ULL << *shift) - 1);
buffer_list[0].addr &= ~0ull << *shift;
......
......@@ -567,12 +567,12 @@ static int __devinit nes_probe(struct pci_dev *pcidev, const struct pci_device_i
/* Init the adapter */
nesdev->nesadapter = nes_init_adapter(nesdev, hw_rev);
nesdev->nesadapter->et_rx_coalesce_usecs_irq = interrupt_mod_interval;
if (!nesdev->nesadapter) {
printk(KERN_ERR PFX "Unable to initialize adapter.\n");
ret = -ENOMEM;
goto bail5;
}
nesdev->nesadapter->et_rx_coalesce_usecs_irq = interrupt_mod_interval;
/* nesdev->base_doorbell_index =
nesdev->nesadapter->pd_config_base[PCI_FUNC(nesdev->pcidev->devfn)]; */
......
......@@ -285,6 +285,21 @@ struct nes_device {
};
static inline __le32 get_crc_value(struct nes_v4_quad *nes_quad)
{
u32 crc_value;
crc_value = crc32c(~0, (void *)nes_quad, sizeof (struct nes_v4_quad));
/*
* With commit ef19454b ("[LIB] crc32c: Keep intermediate crc
* state in cpu order"), behavior of crc32c changes on
* big-endian platforms. Our algorithm expects the previous
* behavior; otherwise we have RDMA connection establishment
* issue on big-endian.
*/
return cpu_to_le32(crc_value);
}
static inline void
set_wqe_64bit_value(__le32 *wqe_words, u32 index, u64 value)
{
......
......@@ -370,11 +370,11 @@ int schedule_nes_timer(struct nes_cm_node *cm_node, struct sk_buff *skb,
int ret = 0;
u32 was_timer_set;
if (!cm_node)
return -EINVAL;
new_send = kzalloc(sizeof(*new_send), GFP_ATOMIC);
if (!new_send)
return -1;
if (!cm_node)
return -EINVAL;
/* new_send->timetosend = currenttime */
new_send->retrycount = NES_DEFAULT_RETRYS;
......@@ -947,6 +947,7 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
nes_debug(NES_DBG_CM, "destroying listener (%p)\n", listener);
kfree(listener);
listener = NULL;
ret = 0;
cm_listens_destroyed++;
} else {
......@@ -2319,6 +2320,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
struct iw_cm_event cm_event;
struct nes_hw_qp_wqe *wqe;
struct nes_v4_quad nes_quad;
u32 crc_value;
int ret;
ibqp = nes_get_qp(cm_id->device, conn_param->qpn);
......@@ -2435,8 +2437,8 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
nes_quad.TcpPorts[1] = cm_id->local_addr.sin_port;
/* Produce hash key */
nesqp->hte_index = cpu_to_be32(
crc32c(~0, (void *)&nes_quad, sizeof(nes_quad)) ^ 0xffffffff);
crc_value = get_crc_value(&nes_quad);
nesqp->hte_index = cpu_to_be32(crc_value ^ 0xffffffff);
nes_debug(NES_DBG_CM, "HTE Index = 0x%08X, CRC = 0x%08X\n",
nesqp->hte_index, nesqp->hte_index & adapter->hte_index_mask);
......@@ -2750,6 +2752,7 @@ void cm_event_connected(struct nes_cm_event *event)
struct iw_cm_event cm_event;
struct nes_hw_qp_wqe *wqe;
struct nes_v4_quad nes_quad;
u32 crc_value;
int ret;
/* get all our handles */
......@@ -2827,8 +2830,8 @@ void cm_event_connected(struct nes_cm_event *event)
nes_quad.TcpPorts[1] = cm_id->local_addr.sin_port;
/* Produce hash key */
nesqp->hte_index = cpu_to_be32(
crc32c(~0, (void *)&nes_quad, sizeof(nes_quad)) ^ 0xffffffff);
crc_value = get_crc_value(&nes_quad);
nesqp->hte_index = cpu_to_be32(crc_value ^ 0xffffffff);
nes_debug(NES_DBG_CM, "HTE Index = 0x%08X, After CRC = 0x%08X\n",
nesqp->hte_index, nesqp->hte_index & nesadapter->hte_index_mask);
......
......@@ -156,15 +156,14 @@ static void nes_nic_tune_timer(struct nes_device *nesdev)
spin_lock_irqsave(&nesadapter->periodic_timer_lock, flags);
if (shared_timer->cq_count_old < cq_count) {
if (cq_count > shared_timer->threshold_low)
shared_timer->cq_direction_downward=0;
}
if (shared_timer->cq_count_old >= cq_count)
if (shared_timer->cq_count_old <= cq_count)
shared_timer->cq_direction_downward = 0;
else
shared_timer->cq_direction_downward++;
shared_timer->cq_count_old = cq_count;
if (shared_timer->cq_direction_downward > NES_NIC_CQ_DOWNWARD_TREND) {
if (cq_count <= shared_timer->threshold_low) {
if (cq_count <= shared_timer->threshold_low &&
shared_timer->threshold_low > 4) {
shared_timer->threshold_low = shared_timer->threshold_low/2;
shared_timer->cq_direction_downward=0;
nesdev->currcq_count = 0;
......@@ -1728,7 +1727,6 @@ int nes_napi_isr(struct nes_device *nesdev)
nesdev->int_req &= ~NES_INT_TIMER;
nes_write32(nesdev->regs+NES_INTF_INT_MASK, ~(nesdev->intf_int_req));
nes_write32(nesdev->regs+NES_INT_MASK, ~nesdev->int_req);
nesadapter->tune_timer.timer_in_use_old = 0;
}
nesdev->deepcq_count = 0;
return 1;
......@@ -1867,7 +1865,6 @@ void nes_dpc(unsigned long param)
nesdev->int_req &= ~NES_INT_TIMER;
nes_write32(nesdev->regs + NES_INTF_INT_MASK, ~(nesdev->intf_int_req));
nes_write32(nesdev->regs+NES_INT_MASK, ~nesdev->int_req);
nesdev->nesadapter->tune_timer.timer_in_use_old = 0;
} else {
nes_write32(nesdev->regs+NES_INT_MASK, 0x0000ffff|(~nesdev->int_req));
}
......
......@@ -962,7 +962,7 @@ struct nes_arp_entry {
#define DEFAULT_JUMBO_NES_QL_LOW 12
#define DEFAULT_JUMBO_NES_QL_TARGET 40
#define DEFAULT_JUMBO_NES_QL_HIGH 128
#define NES_NIC_CQ_DOWNWARD_TREND 8
#define NES_NIC_CQ_DOWNWARD_TREND 16
struct nes_hw_tune_timer {
//u16 cq_count;
......
......@@ -929,7 +929,7 @@ static struct ib_pd *nes_alloc_pd(struct ib_device *ibdev,
NES_MAX_USER_DB_REGIONS, nesucontext->first_free_db);
nes_debug(NES_DBG_PD, "find_first_zero_biton doorbells returned %u, mapping pd_id %u.\n",
nespd->mmap_db_index, nespd->pd_id);
if (nespd->mmap_db_index > NES_MAX_USER_DB_REGIONS) {
if (nespd->mmap_db_index >= NES_MAX_USER_DB_REGIONS) {
nes_debug(NES_DBG_PD, "mmap_db_index > MAX\n");
nes_free_resource(nesadapter, nesadapter->allocated_pds, pd_num);
kfree(nespd);
......@@ -1327,7 +1327,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
(long long unsigned int)req.user_wqe_buffers);
nes_free_resource(nesadapter, nesadapter->allocated_qps, qp_num);
kfree(nesqp->allocated_buffer);
return ERR_PTR(-ENOMEM);
return ERR_PTR(-EFAULT);
}
}
......@@ -1674,6 +1674,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
}
nes_debug(NES_DBG_CQ, "CQ Virtual Address = %08lX, size = %u.\n",
(unsigned long)req.user_cq_buffer, entries);
err = 1;
list_for_each_entry(nespbl, &nes_ucontext->cq_reg_mem_list, list) {
if (nespbl->user_base == (unsigned long )req.user_cq_buffer) {
list_del(&nespbl->list);
......@@ -1686,7 +1687,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
if (err) {
nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);
kfree(nescq);
return ERR_PTR(err);
return ERR_PTR(-EFAULT);
}
pbl_entries = nespbl->pbl_size >> 3;
......@@ -1831,9 +1832,6 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
}
}
nes_debug(NES_DBG_CQ, "iWARP CQ%u create timeout expired, major code = 0x%04X,"
" minor code = 0x%04X\n",
nescq->hw_cq.cq_number, cqp_request->major_code, cqp_request->minor_code);
if (!context)
pci_free_consistent(nesdev->pcidev, nescq->cq_mem_size, mem,
nescq->hw_cq.cq_pbase);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment